After a surge in network activity, checking the logs of Apache that's serving a casual minimal WordPress site, through a Cloudflare proxy, I see the following entry repeated hundreds of times: - - [22/Aug/2022:01:59:06 +0000] "POST /wp-content/plugins/the-social-links/assets/css/font-awesome.min.css HTTP/1.1" 302 565 "-" "Mozilla/5.0 (X11; U; Linux i686; pl; rv: Gecko/20070220 Firefox/"

Now, HTTP attacks are not news to me, but the strange things is that this attack is targeting a CSS resource with a POST request.

How can this be useful to the attacker in any possible way?

  • 2
    In theory the generation of CSS files could be done by an application dynamically - therefore the application could be vulnerable to POST requests. However, I haven't seen any such application yet. Aug 22, 2022 at 16:33

1 Answer 1


The only thing I could think off:

When a CDN is implemented, like Cloudflare, then GET requests for static resources are offloaded to the CDN.

A POST request on the other hand will (often) still be forwarded to a back-end server.

That means more traffic and load for the back-end server and potentially impact the service.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .