Vulnerability scanners, bots, and scripts constantly probe web apps for WordPress, PHP, .env files, and other non-Elixir targets.

Phoenix routing is based on pattern matching, which is much faster than regular expressions. So unless you are doing some really heavy processing on all requests, reaching natural “no route” result should be very cheap.

PlugDeflect pattern-matches these requests and returns 404 immediately — no router, no controller, no wasted cycles.

You are wasting cycles because you are passing all traffic, including legitimate one through the regular expressions.

How I approach this? At the reverse proxy level, where it should be approached.