Plug_deflect - deflect invalid traffic

What is the result for the caller when their HTTP request is deflected? Do they get a 404, something else?

Looks like it

How I approach this? At the reverse proxy level, where it should be approached.

Vulnerability scanners, bots, and scripts constantly probe web apps for WordPress, PHP, .env files, and other non-Elixir targets.

Phoenix routing is based on pattern matching, which is much faster than regular expressions. So unless you are doing some really heavy processing on all requests, reaching natural “no route” result should be very cheap.

PlugDeflect pattern-matches these requests and returns 404 immediately — no router, no controller, no wasted cycles.

You are wasting cycles because you are passing all traffic, including legitimate one through the regular expressions.