🧱 notwp

Redirects all /wp-* routes (common WordPress bot routes) to a funny harmless URL 🚀

Install

npm install notwp

pnpm install notwp

Usage

Usage Examples

Express.js:

import express from "express";
import notwp from "notwp";

const app = express();

app.use(notwp());
// or with options
app.use(
  notwp({
    logAttempts: true,
    additionalRoutes: ["/phpmyadmin", "/admin.php"],
  })
);

Next.js (middleware.js):

import { NextResponse } from "next/server";
import notwp from "notwp";

export function middleware(request) {
  const mockRes = {
    redirect: (status, url) => NextResponse.redirect(url, { status }),
  };

  const mockNext = () => NextResponse.next();

  return notwp()(request, mockRes, mockNext);
}

export const config = {
  matcher: "/((?!api|_next/static|_next/image|favicon.ico).*)",
};

Nuxt.js (server/middleware/notwp.js):

import { defineEventHandler, getRequestIP, sendRedirect } from "h3";
import notwp from "notwp";

export default defineEventHandler((event) => {
  const path = event.node.req.url.split("?")[0];

  if (notwp.check(path)) {
    console.log(
      `[notwp] Blocked WordPress attempt: ${path} from ${
        getRequestIP(event) || "unknown"
      }`
    );
    return sendRedirect(
      event,
      "https://www.youtube.com/watch?v=dQw4w9WgXcQ",
      302
    );
  }
});

SvelteKit (src/hooks.server.js):

import notwp from "notwp";

const wpMiddleware = notwp();

export const handle = ({ event, resolve }) => {
  const mockRes = {
    redirect: (status, url) =>
      new Response(null, {
        status,
        headers: { Location: url },
      }),
  };

  const mockNext = () => resolve(event);

  return wpMiddleware(event.request, mockRes, mockNext);
};

🧠 Not affiliated with WordPress or the WordPress Foundation. This simply deflects probing bots hitting /wp-* paths.