Setup Rules

A checklist for configuring the seven WAF layers that filter traffic before it reaches your site.

2 min read

Choose which hosting networks, matched by ASN, and TOR exit nodes to block or challenge, then deploy the rule to your Cloudflare zone.

3 min read

Apply a Cloudflare managed challenge to traffic from AWS, Google Cloud and Azure, or to visitors outside the countries you select.

2 min read

Challenge visitors who use known VPN providers when they reach wp-login.php or your custom login URL, then deploy the rule to Cloudflare.

3 min read

Block aggressive crawlers, generic bot user agents, exploit scanners, sensitive WordPress paths and common attack patterns with a Cloudflare WAF rule.

3 min read

Let verified bot categories, backup services and uptime monitors skip your Cloudflare WAF rules so that blocking rules do not stop them.

5 min read