Docly Developers
Knowledge base Pitfall By design

Probes for .git and other flagged URLs count against your IP

In shortRequests for paths that scanners look for - .git, .claude, .vscode and the other tool folders, and flagged URLs such as wp-login.php or .env - are treated as probes when the site does not have them. Each different probe adds a flag to the IP address it came from, and enough flags get the address blocked by the firewall for 30 days, longer for repeat blocks. Checking your own site this way counts too.
Applies to SecurityFirewallPublished sites

  1. What you'll see

    You check that your site does not leak a tool folder — curl https://your-site/.claude/CLAUDE.md, /.git/config, /.env — or run a security scanner against it from your office. A while later your own IP address is blocked from every Docly site, and the visitors behind the same office or mobile network address are blocked with you.

  2. What's actually happening

    • Tool folders are never served. A path with a segment such as .claude, .git, .svn, .hg, .vscode, .vs, .idea or .cursor answers 404 on every published site and is left out of the listing functions — getFiles, getFolders, getPages, listFiles, listFolders, getFilenames and getAllTags — so a menu or an overview page never links to one. Reading a path you name yourself, such as getFile or include, still works. The list is maintained by Docly.
    • A request for one of them, or for a flagged URL pattern, is a probe — but only when the site does not have the address. A real page at a flagged path is an ordinary page and is not counted. Ordinary 404s are not counted either.
    • Each probe flags the IP address. The same URL counts once. When the number of different probes reaches a limit, which depends on how much the country of the address is trusted, the firewall blocks the address on all Docly sites: 30 days the first time, then 90, then 365.
    • From security level elevated, a probe gets the Turnstile check (status 403) instead of the site's 404 page, and it still counts.

  3. What to do

    • Do not test for tool folders on a live site from your own network. Trust that they are never served, and verify your .claude setup another way — for example by checking that the files are not in a folder that is published at all.
    • Run security scanners from a disposable address, or ask Docly before you scan, so the block does not hit your office.
    • To check that a file you placed at the site root is not public, request that exact file once: a plain 404 for a path that is not flagged does not count.
    • If a page of yours really lives at a flagged path, it is served normally and visitors who open it are not flagged.

Last reviewed 17 Oct 2026