Cloudflare firewall rules-block bad bots and attacks
Use Cloudflare WAF and security rules to block malicious IPs, bot traffic, country-based attacks, and brute-force attempts before they reach your server.
UnderHost NOC
Network Operations
Cloudflare's security features filter malicious traffic before it reaches your server. Even the free plan provides meaningful protection against bots, scrapers, and DDoS traffic through global threat intelligence.
Security level
The security level controls how aggressively Cloudflare challenges suspicious visitors. Go to Security → Settings:
| Level | Challenges |
|---|---|
| Essentially Off | Only threats rated critical |
| Low | Threats with high risk rating |
| Medium (default) | Moderate-risk IPs |
| High | Most IPs with any suspicious history-may challenge legitimate visitors |
| I'm Under Attack! | All visitors complete a JS challenge-use only during active attacks |
For most sites, Medium is the right default. Increase to High during unusual traffic spikes.
Bot Fight Mode
Enable Bot Fight Mode at Security → Bots. This detects and challenges automated bot traffic based on Cloudflare's bot intelligence. Legitimate search engine crawlers (Googlebot, Bingbot) are allowed through. Enable it-it has no impact on real visitors.
WAF managed rules
The Cloudflare Web Application Firewall (WAF) provides managed rule sets for common attack patterns. On paid plans, enable WordPress-specific rules under Security → WAF → Managed rules. The free plan includes basic managed rules.
Custom security rules
Go to Security → WAF → Custom rules → Create rule. Examples:
Block a specific IP address:
- If: IP Source Address equals
1.2.3.4 - Then: Block
Block requests with a suspicious user-agent:
- If: User Agent contains
zgrab - Then: Block
Challenge visitors to the WordPress login page:
- If: URL path contains
/wp-login.php - Then: Managed Challenge
Block a country
Go to Security → WAF → Custom rules → Create rule:
- If: Country equals [select countries]
- Then: Block (or Managed Challenge if you prefer a less aggressive option)
Use country blocking with care-it blocks all visitors from that country, including VPN users and legitimate traffic.
Protect your site
Enable Cloudflare firewall rules to defend against attacks and malicious traffic.
