Cloudflare WAF rules for WordPress

What it does

A web application firewall at the edge filters requests before they consume your hosting resources. Instead of asking you to write Cloudflare rules by hand, the plugin ships five curated groups and deploys them to your zone through the Cloudflare API.

The five rule groups

Each group is a switch, and the important choices inside each group are switches too:

• Allow good bots: Cloudflare-verified crawler categories plus named allowlists for backup, monitoring, image, SEO and security services you actually use
• Block crawlers & WP paths: aggressive crawlers, exploit scanners (Nikto, sqlmap, masscan, nmap), sensitive WordPress paths like XML-RPC and wp-config, and common injection patterns
• Block web hosts & TOR: traffic originating from hosting providers and TOR exit nodes, which is rarely human
• Challenge cloud providers & countries: present a challenge instead of a hard block
• Challenge VPN & login: extra friction exactly where attacks concentrate

How it works

Connect your Cloudflare API token, pick your groups, deploy. The plugin creates and updates its ruleset through Cloudflare's Rulesets API, can remove its rules just as cleanly, and gives you preview, live-rules and analytics views so you can see what the rules are actually doing.

Everything runs against your own Cloudflare account. The plugin never proxies your traffic and only talks to api.cloudflare.com with the token you provide.