How to Secure WordPress on VPS With Cloudflare WAF, From Setup to Bot Protection

A VPS is your own private server, so nobody else is watching over it or fixing problems for you. That means if your WordPress site is not protected, it stays open for anyone to try and break in. This is why securing WordPress on your VPS with Cloudflare WAF Rules matters so much. It is the first thing you should do once your site is live.

This guide keeps things simple. First, we will get WordPress set up on your VPS. Then, we will cover how to secure WordPress on VPS with Cloudflare WAF, so bad actors get blocked before they ever reach your website.

Why WordPress on a VPS Needs More Than Default Security

Almost every WordPress site works the same under the hood. Same login page, same folder names, same files. A bot built to attack one site can attack thousands of others. Bots scan IP ranges and hit the same requests at anything that is built with WordPress. Shared hosting absorbs a lot of this for you. On a VPS, that responsibility is yours. The good news is, it is not hard once you know what to set up.

Setting Up WordPress on a VPS

Before locking anything down, you first need WordPress actually running on your VPS. Here is the short version of what that takes.

1. Buy a domain. Pick something simple and go with a normal extension like .com.
2. Get a VPS. You do not need a powerful one. 2 CPU cores and 2GB of RAM is enough for most WordPress sites.
3. API: Which provider(s) were used (e.g., WPSCAN + WPVulnerability or PatchStack).
4. Point your domain to Cloudflare. This routes your traffic through Cloudflare before it reaches your server, which is also required for Cloudflare WAF to work later. Cloudflare has an official guide for adding your domain and setting up proxied DNS records if you want the full walkthrough.
5. Connect to your VPS and install WordPress. Log in over SSH, then install WordPress using whatever method your VPS provider offers, a one-command script, a control panel, or their own installer. Most providers publish their own step-by-step WordPress guide, so follow the one that matches your setup.
6. Set up a basic firewall on your VPS. A firewall controls which doors into your server are open. Most VPS providers include a simple firewall panel for this.

Once your site is live at your domain, WordPress is done. Now comes the part that actually matters, locking it down. People often skip this part, and honestly it is the part that matters most. Your site works, but right now it is wide open. Anyone who knows where to look can hit your login page, your config file, or your XML-RPC endpoint directly. That is what the next section fixes.

How to Secure WordPress on VPS With Cloudflare WAF Rules

This is the real point of this guide, so let us get into it properly. The best part is you do not need to be technical to set this up. Ultimate Security handles all the hard parts for you.

What Cloudflare WAF Actually Protects Against

Cloudflare’s Web Application Firewall (WAF) sits at the edge of the internet, between visitors and your server. It filters traffic before it ever reaches your VPS, which means bad requests get blocked at Cloudflare’s network instead of eating up your server’s CPU and bandwidth.

For a WordPress site specifically, this covers a handful of very common attack types:

• Brute force login attempts against WordPress logins, where bots try thousands of username and password combinations.
• Aggressive crawlers and scrapers that hammer your site with requests and slow it down for real visitors.
• Exploit scanners like Nikto, SQLMap, or Nmap that probe your site looking for known vulnerabilities.
• Direct attacks on sensitive files, like wp-config.php or the XML-RPC endpoint, which attackers target because they know exactly what those files do.
• Traffic from data centers, VPNs, and TOR, which is where a disproportionate share of automated attacks come from, since real visitors mostly connect from home or mobile networks.

None of this replaces strong WordPress passwords and two-factor authentication and regular updates. What it does is stop a huge chunk of automated noise before it even reaches the point where those things matter.

The Manual Way to Set Up Cloudflare WAF Rules

You can build all of this yourself directly in the Cloudflare dashboard. It involves writing custom firewall rule expressions using Cloudflare’s rule syntax, one for blocking known bad paths, another for rate limiting login attempts, another for filtering hosting provider ASNs, and so on.

This works, and plenty of technical site owners do exactly this. But it also means maintaining that logic yourself. New attack paths show up, plugins add new URLs worth protecting, and if you get a rule wrong, you can accidentally block real visitors instead of bad ones. It is doable, just not something you want to be doing every few months by hand.

Set Up Cloudflare WAF Rules for WordPress Using Ultimate Security

This is where Ultimate Security comes in. It handles the entire Cloudflare WAF setup from inside your WordPress dashboard, so you never have to write a rule expression yourself.

1. Connect your Cloudflare account. Head to WAF Rules > Cloudflare Setup in the plugin and turn on Enable WAF Rules. Then connect your Cloudflare account using one of three methods:

• API Token (recommended): a scoped token with just Zone > WAF > Edit and Zone > Zone > Read permissions, generated from your Cloudflare profile. This is the safest option because it cannot touch anything outside what the plugin actually needs.
• Email + Global API Key: works, but this key gives full access to your entire Cloudflare account, so treat it carefully.
• OAuth: connects through a self-managed OAuth application without ever sharing a password or master key.

You can save multiple Cloudflare accounts here too, which is handy if you manage more than one site.

2. Allow good bots first. Before you block anything, tell the plugin which bots to leave alone. This includes Google and Bing’s crawlers, backup plugins like UpdraftPlus, uptime monitors like Pingdom, image optimizers, SEO tools like Ahrefs if you use them, and social preview bots so shared links still show a proper card. This step matters more than it sounds like it should, because it runs first and keeps your later blocking rules from accidentally catching services you actually rely on.

3. Block aggressive crawlers and sensitive WordPress paths. This is where the real protection kicks in. It blocks known exploit scanners, generic bot patterns in user agents, and locks down files attackers specifically go looking for: xmlrpc.php, wp-config.php, install.php, readme.html, and license.txt. If you do not use the WordPress REST API, you can block wp-json here too.

4. Block web hosts and TOR traffic. Most real visitors connect from home internet or mobile networks, not data centers. This rule blocks or challenges traffic from providers like DigitalOcean, Hetzner, OVH, and similar hosting networks, plus TOR exit nodes, since that is where a lot of automated attacks actually originate.

5. Challenge large cloud providers and countries. This puts a quick, mostly invisible challenge in front of traffic from AWS, Google Cloud, and Azure, since a lot of scripted attacks run on rented cloud compute. If your site only serves a specific country or region, you can also challenge visitors from everywhere else.

6. Challenge VPN traffic on your login page. Your wp-login.php page is the single most attacked spot on a WordPress site. This rule specifically challenges visitors using VPN services (NordVPN, ExpressVPN, Surfshark, and others) when they try to reach it, which stops a large share of both manual and automated login attacks without blocking legitimate VPN users outright.

7. Preview and deploy your rules. Once everything is configured, head to Preview & Deploy. The plugin converts every toggle into the actual Cloudflare rule expressions behind the scenes, and shows you exactly what each one does before anything goes live. Pick your Cloudflare zone, hit Deploy Rules, and you are protected.

Why This WAF Setup Will Not Touch Your Existing Cloudflare Rules

If you already have custom rules set up manually in Cloudflare, you do not need to worry about conflicts. Ultimate Security only manages the rules it creates itself. It will not overwrite, delete, or interfere with anything you built by hand, so you can layer this on top of an existing setup safely.

Optimizing Your WordPress VPS After Securing It

Once security is handled, a few habits keep your VPS running lean without needing more server resources.

Keep Plugins and Themes Lean

Every plugin you install is one more thing that can slow your site down or introduce a vulnerability later. Stick to plugins you actually need, avoid ones that lean on third party servers for basic functionality, and remove anything you are not actively using.

Optimize Images and Media Delivery

Serve images in WebP format where you can, and lazy load anything below the fold. Avoid letting WordPress auto-scale large images on the fly, since that burns server resources for something you can just do properly once at upload time.

Frequently Asked Questions

Final Thoughts on Securing Your WordPress VPS

A VPS gives you real control over your WordPress site, but that control comes with the job of actually locking the front door yourself. Getting WordPress installed is the easy part. But knowing how to secure WordPress on VPS with Cloudflare WAF is what actually keeps your site standing once it is live. Once your Cloudflare WAF rules are live through Ultimate Security, most of the daily noise, the scanners, the bots, and the login attempts get stopped. That is the difference between reacting to attacks and never seeing them in the first place.