Probes for .git and other flagged URLs count against your IP

What you'll see

You check that your site does not leak a tool folder — curl https://your-site/.claude/CLAUDE.md, /.git/config, /.env — or run a security scanner against it from your office. A while later your own IP address is blocked from every Docly site, and the visitors behind the same office or mobile network address are blocked with you.

What's actually happening

• Tool folders are never served. A path with a segment such as .claude, .git, .svn, .hg, .vscode, .vs, .idea or .cursor answers 404 on every published site and is left out of file listings. The list is maintained by Docly.
• A request for one of them, or for a flagged URL pattern, is a probe — but only when the site does not have the address. A real page at a flagged path is an ordinary page and is not counted. Ordinary 404s are not counted either.
• Each probe flags the IP address. The same URL counts once. When the number of different probes reaches a limit, which depends on how much the country of the address is trusted, the firewall blocks the address on all Docly sites: 30 days the first time, then 90, then 365.
• From security level elevated, a probe gets the Turnstile check (status 403) instead of the site's 404 page, and it still counts.

What to do

• Do not test for tool folders on a live site from your own network. Trust that they are never served, and verify your .claude setup another way — for example by checking that the files are not in a folder that is published at all.
• Run security scanners from a disposable address, or ask Docly before you scan, so the block does not hit your office.
• To check that a file you placed at the site root is not public, request that exact file once: a plain 404 for a path that is not flagged does not count.
• If a page of yours really lives at a flagged path, it is served normally and visitors who open it are not flagged.