[Definition]
# Matches Traefik CLF access log lines where the response status is 403 or 404.
# Banning on these two codes catches vulnerability scanners (403) and path probers (404)
# without touching legitimate 401 auth challenges or 429 rate-limit responses.
failregex = ^<HOST> \S+ \S+ \[.*?\] ".*?" (?:403|404) .*$
ignoreregex =
