hlstatsz-web/web.config at main · SnipeZilla/hlstatsz-web · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
<?xml version="1.0" encoding="UTF-8"?>
<!-- HLstatsZ – IIS hardening -->
<configuration>
    <system.webServer>

        <!-- Security headers -->
        <httpProtocol>
            <customHeaders>
                <remove name="X-Powered-By" />
                <add name="X-Content-Type-Options"  value="nosniff" />
                <add name="X-Frame-Options"         value="SAMEORIGIN" />
                <add name="Referrer-Policy"         value="strict-origin-when-cross-origin" />
                <add name="X-XSS-Protection"        value="1; mode=block" />
                <add name="Permissions-Policy"      value="geolocation=(), microphone=(), camera=()" />
            </customHeaders>
        </httpProtocol>

        <!-- No directory browsing -->
        <directoryBrowse enabled="false" />

        <rewrite>
            <rules>

                <!-- Block AI training bots site-wide -->
                <rule name="Block AI Crawlers" stopProcessing="true">
                    <match url=".*" />
                    <conditions>
                        <add input="{HTTP_USER_AGENT}"
                             pattern="GPTBot|OAI-SearchBot|ClaudeBot|anthropic-ai|Google-Extended|Amazonbot|Bytespider|CCBot|PetalBot|DataForSeoBot|PerplexityBot|YouBot|cohere-ai|AI2Bot|Diffbot|magpie-crawler|omgili"
                             ignoreCase="true" />
                    </conditions>
                    <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
                </rule>

                <!-- Block SEO scrapers from AJAX/paginated endpoints -->
                <rule name="Block Scrapers on AJAX" stopProcessing="true">
                    <match url=".*" />
                    <conditions logicalGrouping="MatchAll">
                        <add input="{HTTP_USER_AGENT}"
                             pattern="AhrefsBot|SemrushBot|MJ12bot|DotBot|BLEXBot|serpstatbot"
                             ignoreCase="true" />
                        <add input="{QUERY_STRING}"
                             pattern="ajax=|mode=actioninfo|mode=playersessions|mode=playerhistory"
                             ignoreCase="true" />
                    </conditions>
                    <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
                </rule>

                <!-- Block empty User-Agent -->
                <rule name="Block Empty UA" stopProcessing="true">
                    <match url=".*" />
                    <conditions>
                        <add input="{HTTP_USER_AGENT}" pattern="^$" />
                    </conditions>
                    <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
                </rule>

                <!-- Reject malformed semicolon-polluted query strings -->
                <rule name="Block Malformed Params" stopProcessing="true">
                    <match url=".*" />
                    <conditions>
                        <add input="{QUERY_STRING}" pattern="3[Bb](obj|vpage|page)_" ignoreCase="true" />
                    </conditions>
                    <action type="CustomResponse" statusCode="400" statusReason="Bad Request" statusDescription="Bad Request" />
                </rule>

            </rules>
        </rewrite>

        <!-- Block direct access to sensitive files -->
        <security>
            <requestFiltering>
                <hiddenSegments>
                    <add segment="updater" />
                    <add segment="sql" />
                    <add segment="cache" />
                    <add segment="bots" />
                    <add segment=".git" />
                    <add segment="_error.txt" />
                    <add segment="config.php" />
                    <add segment="composer.json" />
                    <add segment="composer.lock" />
                </hiddenSegments>
                <fileExtensions allowUnlisted="true">
                    <add fileExtension=".env"  allowed="false" />
                    <add fileExtension=".log"  allowed="false" />
                </fileExtensions>
                <denyQueryStringSequences>
                    <add sequence="&lt;script" />
                    <add sequence="%3cscript" />
                </denyQueryStringSequences>
            </requestFiltering>
        </security>

    </system.webServer>
</configuration>