WAF Rules
Deploy and manage Cloudflare WAF rules from WordPress.
11 articles
-
Cloudflare Setup
Enable WAF Rules and connect your Cloudflare account with an API token, an email and Global API Key, or a self-managed OAuth application.
-
Preview & Deploy
Review the Cloudflare rule expressions generated from your settings, copy them, and deploy or remove the plugin-managed WAF rules for a zone.
-
Live Rules
Pick a Cloudflare zone and load the WAF rules that are currently active on it, to confirm what is live rather than what is drafted.
-
Analytics
Pull Cloudflare traffic and security metrics for a chosen zone and review them over the last 24 hours, 7 days or 30 days.
-
Guidance
Read the purpose, benefits, trade-offs and recommended settings for each Cloudflare WAF rule group before you enable and deploy it.
Setup Rules
Configure the Cloudflare WAF rule groups before you deploy them.
-
Setup Rules Overview
A checklist for configuring the seven WAF layers that filter traffic before it reaches your site.
-
Block Web Hosts & TOR
Choose which hosting networks, matched by ASN, and TOR exit nodes to block or challenge, then deploy the rule to your Cloudflare zone.
-
Challenge Cloud Providers & Countries
Apply a Cloudflare managed challenge to traffic from AWS, Google Cloud and Azure, or to visitors outside the countries you select.
-
Challenge VPN & Login
Challenge visitors who use known VPN providers when they reach wp-login.php or your custom login URL, then deploy the rule to Cloudflare.
-
Block Crawlers & WP Paths
Block aggressive crawlers, generic bot user agents, exploit scanners, sensitive WordPress paths and common attack patterns with a Cloudflare WAF rule.
-
Allow Good Bots
Let verified bot categories, backup services and uptime monitors skip your Cloudflare WAF rules so that blocking rules do not stop them.
Secure your site today
Install the free plugin from WordPress.org and set up real protection with the guided setup wizard. Upgrade to Pro whenever you need more.