Cloudflare WAF Rules Configuration Guide: Website Security Hardening

Cloudflare WAF custom rules configuration tutorial: enable managed rulesets, Geo restriction, WordPress admin protection, bot blocking, and rate limiting. Complete edge security in four steps.

Scope

This tutorial is for site operators and security ops with a site already on Cloudflare CDN. Cloudflare WAF (Web Application Firewall) provides three core capabilities: managed rulesets, custom rules, and rate limiting. It intercepts SQL injection, XSS, file inclusion, malicious crawlers, and other common web attacks. Whether origin is Nginx, Apache, or WordPress, you can configure WAF rules with this tutorial for active defense.

Prerequisites

• Cloudflare account; domain already on Cloudflare (DNS status Proxied / orange cloud)
• Cloudflare plan: Free supports core WAF rules; Pro and above support custom rules and rate limiting
• Logged into Cloudflare Dashboard
• Recommended: enable Under Attack Mode first to understand baseline defense

Mechanism

Cloudflare WAF runs on the global Anycast edge network and filters requests before they reach origin. Core mechanisms:

• Managed Rulesets: preset rule library maintained by the Cloudflare security team, based on OWASP ModSecurity Core Rule Set (CRS) and continuously updated. Enable to intercept known vulnerability attacks
• Custom Rules: flexible condition logic (AND/OR). Match request attributes (IP country, URI path, User-Agent, request method, Cookie, etc.) and execute Allow, Block, or Challenge (JS Challenge/Captcha)
• Rate Limiting: set a threshold for matching traffic; exceeding the cap in a given time window triggers the limit action. Defends against HTTP floods and CC attacks
• Core advantage: all rules execute at edge nodes. Malicious traffic is filtered before it reaches origin and does not consume origin resources

Procedure

Step 1: Enable managed WAF ruleset

• Log in to Cloudflare Dashboard and open your domain
• Click left menu Security → WAF
• On the Managed Rules tab, click Deploy Cloudflare Managed Ruleset
• Set ruleset action to Block; set sensitivity to High
• Click Deploy

Recommended Paranoia Level: Level 2 (balances security and false positives). Intercepts about 90% of common attacks.

Step 2: Add custom rule — block non-China traffic

If the site mainly serves users in China, restrict access to China only:

• On the WAF page, open the Custom Rules tab
• Click Create Rule and configure as follows:

Rule name: Block Non-CN Traffic
Field: IP Country
Operator: is not equal
Value: CN
Action: Managed Challenge (JS Challenge)
or choose Block (strict mode)

Step 3: Add custom rule — protect WordPress admin

Rule name: Protect WP-Admin
Field: URI Path
Operator: contains
Value: /wp-login.php
AND Logic:
  Field: IP Country
  Operator: is not equal
  Value: CN
Action: Block
Note: allow only China IPs to access the login page

Step 4: Add custom rule — block known malicious bots

Rule name: Block Malicious Bots
Expression Builder:
  (user_agent contains "SemrushBot") OR
  (user_agent contains "AhrefsBot") OR
  (user_agent contains "MJ12bot") OR
  (user_agent contains "python-requests") OR
  (user_agent contains "curl") AND NOT
  (ip.src in {your-server egress IP})
Action: Block

Step 5: Configure rate limiting

• On the WAF page, open the Rate Limiting tab
• Click Create Rate Limit and configure as follows:

Rule name: Protect Login Endpoint
Target URI: /wp-login.php
Request threshold: 20 per minute
Time window: 1 minute
Trigger: same IP requesting /wp-login.php
Action: Block for 10 minutes
Advanced options:

Step 6: Enable WAF log analysis

On the WAF page, open the Security Events tab:
# View blocked request details
# Filter examples:
# - Action: Block
# - Rule ID: specific rule ID
# - Source: Managed/Custom

# Review false positives regularly (weekly recommended)
# On false positive, add the condition to a WAF Skip rule

Verification

Verification 1: Simulated attack tests

# Test SQL injection (should be blocked by WAF)
curl -s "https://your-domain/?id=1' OR '1'='1" -I
# Expected: 403 Forbidden

# Test XSS (should be blocked by WAF)
curl -s "https://your-domain/?q=<script>alert(1)</script>" -I
# Expected: 403 Forbidden

# Access from a non-China IP (test via overseas proxy)
curl -s "https://your-domain/wp-login.php" -I
# Expected: 403 or JS Challenge page

Verification 2: Check Security Events logs

# Log in to Cloudflare Dashboard → Security → Events
# Confirm the following:
# - SQL injection test request appears in the event list
# - Event is labeled with the matched rule ID
# - Action shows Block (not Pass)

FAQ

Q1: Legitimate users blocked after enabling WAF?

First, in Security Events find the false-positive request, and record its IP, Country, URI, and User-Agent. Second, create a Skip rule (in Custom Rules, set action to Skip) and allow based on those attributes: e.g. Skip: WAF Managed Rules. Third, if the false positive comes from a managed rule, open Managed Rules and change that rule action from Block to Log (log only, do not block), and report the false positive to Cloudflare to improve the rule library.

Q2: Free plan is limited. How to maximize protection?

Cloudflare Free does not support the Block action on custom rules. Compensate as follows: ① enable Under Attack Mode (Security → Settings) so visitors get a JS Challenge; ② use IP Access Rules (Security → IP Access Rules) to manually block known malicious IP ranges and countries; ③ use Page Rules (Rules → Page Rules) on a given path (e.g. /wp-login.php) with Security Level: Im Under Attack!; ④ add secondary rate limiting on origin Nginx with the limit_req module; ⑤ upgrade to Pro ($20/month) for a controllable cost and a clear protection gain.

Summary

Cloudflare WAF provides a web application firewall stack from managed rules to custom rules. It defends against SQL injection, XSS, malicious crawlers, and CC attacks. This article covers enabling managed rules, configuring custom rules, and rate limiting for common protection scenarios. Include WAF rules in regular security audits, check Security Events weekly, update rules from attack trends, and keep a continuous security operations loop.