# SPDX-License-Identifier: AGPL-3.0-only
# A request refused. Weaker evidence than a 404: a web application
# firewall, a bot-trap plugin or a rate limiter answers 403 to plenty of
# traffic that is merely unwelcome — on the machine this was written
# for, search-engine crawlers collect them all day on perfectly real
# article URLs. Rules should score it below a 404, or window it tightly
# enough that a crawler's slow drip never accumulates.
parser: http-403
log: http
prefilter: '" 403 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?(?P<query>[^ "]*))? [^"]*" 403 \d+ "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx
