# Cloudflare WAF Rules, Bot Fight Mode and Under Attack Protection

https://bihostnet.com/en/knowledgebase/article/cloudflare-waf-rules-bot-protection-under-attack-mode

## What is Cloudflare WAF?

Cloudflare Web Application Firewall inspects incoming traffic at edge locations, stopping SQL injections, scrapers, and automated brute-force attacks before they hit your hosting server.

## Securing WordPress wp-login.php with Custom WAF Rules

1. Go to **Security > WAF > Custom Rules**.
2. Click **Create Rule** and name it "Protect Admin".
3. Set condition: `(http.request.uri.path eq "/wp-login.php" and ip.src ne YOUR_IP)`.
4. Set Action to **Managed Challenge**.
5. This halts brute-force bot attacks while allowing legitimate administrators seamless access.

## When to Use "Under Attack" Mode

If your website experiences high-volume Layer 7 HTTP flood attacks:

- Enable **Under Attack Mode** from the Cloudflare Overview Quick Actions.
- A 5-second JS verification challenge is served to all incoming requests, eliminating malicious bot traffic at edge nodes.
- Disable once traffic normalizes to optimize user experience.