dotnet api timeouts and action taken

The developers on one of our apps noted that 

The API is intermittently failing, and we are seeing a CORS error in the browser Network tab.

Claude noted that the CORS error is misleading, and it is probably because of a backend API timeout. 

this is almost never an actual CORS policy misconfiguration — it's the browser's error message for "the actual response didn't carry an Access-Control-Allow-Origin header," which happens whenever the request fails or errors out before your CORS middleware gets a chance to run. Since it's intermittent, that's your biggest clue.

Since a lot of bot traffic was seen looking for Wordpress files, they requested blocking those bots which look for non-existent Wordpress files.

Taking Gemini's advice, 

1. Disabled php on the api server, since it's not required by our services - 

sudo a2dismod php8.3

sudo systemctl restart apache2

2. Added one more firewall rule to Cloudflare, the URL being like

ourdomain.org/security/security-rules

(http.host contains "ourdomainname" and http.request.uri.path contains "wp-") or (http.host contains "ourdomainname" and http.request.uri.path contains ".php")

then Block