Remote File Inclusion

What It Means

This request attempted to trick your application into downloading and executing an external resource, typically a backdoor script that would give the attacker control of your application.

Why It Matters

Remote file inclusion (RFI) attacks exploit applications that dynamically include files based on user input. If successful, the attacker can load their own malicious code from an external server and execute it within your application’s context, leading to full server compromise.

Common Triggers

Requests containing external URLs in parameters that normally reference local files, or attempts to use language-specific include functions with remote paths. Most of these are automated scans probing for inclusion vulnerabilities.

Legitimate requests can match too. If your application sends full URLs as form fields or query parameters (for example, links to files in cloud storage), a normal user action can look like an inclusion attempt.

What To Do

Most RFI blocks are real attacks and need no action. If the blocks come from real users of your application, check whether the blocked path normally carries full URLs in its requests. If it does, add an allowed path for it (see Allowlisting URL Paths), as narrow as you can, since an allowed path skips every security check under it.