Block rogue bot traffic with svelte-kit-bot-block

package.json

@@ -14,6 +14,9 @@
 		"lint": "prettier --check . && eslint .",
 		"format": "prettier --write ."
 	},
+	"dependencies": {
+		"svelte-kit-bot-block": "^0.0.7"
+	},
 	"devDependencies": {
 		"@content-collections/core": "^0.12.0",
 		"@content-collections/vite": "^0.2.7",

src/hooks.server.ts

@@ -1,7 +1,22 @@
+import { sequence } from '@sveltejs/kit/hooks';
+import { createHandler, defaultOptions } from 'svelte-kit-bot-block';
 import type { Handle } from '@sveltejs/kit';
 
-export const handle: Handle = async ({ event, resolve }) => {
-	// Preload web fonts.
+// Block rogue bot traffic (WordPress scanners, vulnerability probing, etc.).
+// Requests matching pathname patterns return 404, all other blocks return 410.
+// Run with { log: true, block: false } first to test, then enable blocking.
+const botBlock = createHandler({
+	log: true,
+	block: true,
+	pathnames: [
+		...defaultOptions.pathnames,
+		// Block additional WordPress-related paths not covered by defaults.
+		/\/wp-includes/
+	]
+});
+
+// Preload web fonts.
+const preloadFonts: Handle = async ({ event, resolve }) => {
 	const response = await resolve(event, {
 		preload: ({ type, path }) => {
 			if (type === 'font') {
@@ -12,3 +27,6 @@ export const handle: Handle = async ({ event, resolve }) => {
 	});
 	return response;
 };
+
+// Bot blocking should run first to reject bad requests early.
+export const handle = sequence(botBlock, preloadFonts);