Verify you are human
Please complete the security check to continue...
`;
const SECRET_KEY = '0x4AAAAAAEnaXfrGtLMuf-nMgqA4Bs2wzZg';
// Known bot user-agent patterns
const BOT_PATTERNS = [
'bot', 'crawler', 'spider', 'scraper', 'curl', 'wget',
'python-requests', 'httpclient', 'java/', 'go-http-client',
'okhttp', 'node-fetch', 'axios', 'phantomjs', 'selenium',
'headless', 'puppeteer', 'scrapy', 'mechanize', 'libwww',
'nikto', 'nmap', 'sqlmap', 'masscan', 'zgrab', 'semrush',
'ahrefs', 'dotbot', 'blexbot', 'mj12bot', 'petalbot'
];
function isBot(userAgent) {
if (!userAgent || userAgent.trim() === '') return true;
const ua = userAgent.toLowerCase();
return BOT_PATTERNS.some(pattern => ua.includes(pattern));
}
export default {
async fetch(request) {
const url = new URL(request.url);
const userAgent = request.headers.get('user-agent') || '';
// Block bots at the Worker level
if (isBot(userAgent)) {
return new Response('Access denied', {
status: 403,
headers: { 'Content-Type': 'text/plain' }
});
}
// Block requests missing Accept-Language
if (!request.headers.get('accept-language')) {
return new Response('Access denied', {
status: 403,
headers: { 'Content-Type': 'text/plain' }
});
}
// Server-side token validation endpoint
if (url.pathname === '/api/verify' && request.method === 'POST') {
try {
const body = await request.json();
const token = body.token;
if (!token) {
return new Response(JSON.stringify({ success: false, error: 'Missing token' }), {
status: 400,
headers: { 'Content-Type': 'application/json' }
});
}
const formData = new FormData();
formData.append('secret', SECRET_KEY);
formData.append('response', token);
const result = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
method: 'POST',
body: formData
});
const outcome = await result.json();
if (outcome.success) {
return new Response(JSON.stringify({ success: true }), {
headers: { 'Content-Type': 'application/json' }
});
} else {
return new Response(JSON.stringify({ success: false, 'error-codes': outcome['error-codes'] }), {
status: 400,
headers: { 'Content-Type': 'application/json' }
});
}
} catch (err) {
return new Response(JSON.stringify({ success: false, error: err.message }), {
status: 500,
headers: { 'Content-Type': 'application/json' }
});
}
}
return new Response(HTML, {
headers: { 'Content-Type': 'text/html; charset=utf-8' }
});
}
};