Block rogue bot traffic with svelte-kit-bot-block

[Copilot]

• Rebase branch onto latest main (d4a5cbe)
• Add svelte-kit-bot-block dependency to package.json
• Update hooks.server.ts with bot blocking logic
• Update pnpm-lock.yaml to include svelte-kit-bot-block@0.0.7

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Block rogue traffic</issue_title>
<issue_description>Every now and then my website gets hammered with rogue request:

• /css/colors/blue/index.php
• /wp-includes/assets/index.php
• /1.php
• /wp-admin/css/colors/midnight/about.php
• /wp-includes/js/codemirror/index.php

These are just examples. There are many more requests like this.

I am hosting on Railway and would like to avoid using third party firewalls. What are my options to mitigate these types of requests in a way that the rogue bots don't keep trying?

You would need to think about options to mitigate this within the SvelteKit app or possibly with another service hosted on Railway. Can you do some research about the options I have?</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Block rogue traffic #1125

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[railway-app]

🚅 Deployed to the website-pr-1126 environment in maiertech

Service	Status	Web	Updated (UTC)
website	❌ Build Failed (View Logs)	Web	Mar 18, 2026 at 10:25 am

[maiertech]

@copilot Rebase this PR and get it ready for review.

[Copilot]

@copilot Rebase this PR and get it ready for review.

Done. Rebased onto latest main and also updated pnpm-lock.yaml to include svelte-kit-bot-block@0.0.7 (it was missing from the lockfile). The PR is ready for review with commits 33725db and c3297cf on top of main.