Create WAF rule to block abc.php

Question

Currently, we have WAF rules blocking external requests to xyz.com/abc.php

The rules are extremely easy to bypass.

if we just add “/” behind you are able to hit the abc.php.

To make is blocked by anyhow, I have craeted cloudflare_firewall_rule in tf. code:

resource "cloudflare_filter" "https-clevertap-com-xmlrpc-php" {
  expression = "(http.request.uri.path contains \"*/xmlrpc.php*\")"
  paused     = false
  zone_id    = cloudflare_zone.clevertap-com.id
}
resource "cloudflare_firewall_rule" "Block-clevertap-com-xmlrpc-php" {
  action      = "block"
  description = "Block-xmlrpc"
  filter_id   = cloudflare_filter.https-clevertap-com-xmlrpc-php.id
  paused      = false
  zone_id     = cloudflare_zone.clevertap-com.id
}

but still i can access it by add “/” as xyz.com/abc.php/.