Cloudflare WAF Rules, Bot Fight Mode and Under Attack Protection

What is Cloudflare WAF?

Cloudflare Web Application Firewall inspects incoming traffic at edge locations, stopping SQL injections, scrapers, and automated brute-force attacks before they hit your hosting server.

Securing WordPress wp-login.php with Custom WAF Rules

1. Go to Security > WAF > Custom Rules.
2. Click Create Rule and name it "Protect Admin".
3. Set condition: (http.request.uri.path eq "/wp-login.php" and ip.src ne YOUR_IP).
4. Set Action to Managed Challenge.
5. This halts brute-force bot attacks while allowing legitimate administrators seamless access.

When to Use "Under Attack" Mode

If your website experiences high-volume Layer 7 HTTP flood attacks:

• Enable Under Attack Mode from the Cloudflare Overview Quick Actions.
• A 5-second JS verification challenge is served to all incoming requests, eliminating malicious bot traffic at edge nodes.
• Disable once traffic normalizes to optimize user experience.