# Ban ip by word in path

**URL:** <https://discourse.crowdsec.net/t/ban-ip-by-word-in-path/1132>\
**Category:** crowdsec\
**Created:** [February 1, 2023, 12:06pm UTC](https://discourse.crowdsec.net/t/ban-ip-by-word-in-path/1132 "2023-02-01T12:06:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![daria4dev](https://avatars.discourse-cdn.com/v4/letter/d/f475e1/32.png) [@daria4dev](https://discourse.crowdsec.net/u/daria4dev)\
**Post date:** [February 1, 2023, 12:06pm UTC](https://discourse.crowdsec.net/t/ban-ip-by-word-in-path/1132/1 "2023-02-01T12:06:35Z")

</div>

Hi there,  
Someone attack my server from different ip at the same time and http-probing scenario does not ban it.  
They make request to my server by its hostname (I even do not know how make it unavailable to everyone because it is auto-generated page by webuzo cPanel )  
Frequantly, url request contains wp-login, wp-includes, wp-content so I want ban this ip as soon as parser find this in logs.  
Mine scenario does not work:

```auto
#contributed by daria-zadorozhna
type: trigger
name: daria-zadorozhna/http-wp-files
description: "detect wp-files"
debug: false
filter: "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_path contains '/wp-'"
groupby: evt.Meta.source_ip
blackhole: 5m
labels:
service: http
type: scan
remediation: true

```

Could anyone help me write right scenario?

---

<div class="post-metadata">

**Author:** ![gregory](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/gregory/32/485_2.png) [@gregory](https://discourse.crowdsec.net/u/gregory)\
**Post date:** [February 1, 2023, 1:53pm UTC](https://discourse.crowdsec.net/t/ban-ip-by-word-in-path/1132/2 "2023-02-01T13:53:47Z")

</div>

Can’t help but interested by this too.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [February 6, 2023, 1:42pm UTC](https://discourse.crowdsec.net/t/ban-ip-by-word-in-path/1132/3 "2023-02-06T13:42:37Z")

</div>

Can you provide some details like which log parsers you using? That scenario should work for nginx, apache2. Since you made the file did you restart crowdsec so it loads the file?