How to Protect Your Website with Cloudflare WAF
Cloudflare's web application firewall filters malicious traffic before it reaches your server. Here is how to set it up properly and avoid common mistakes.
Cloudflare WAF protects a website by inspecting incoming requests at Cloudflare's network and blocking or challenging malicious traffic before it reaches your server. To use it well, put your site behind Cloudflare's proxy, use SSL/TLS in Full (strict) mode, enable the managed rulesets your plan includes, add a few custom rules for sensitive paths like login pages, set rate limits on forms and authentication endpoints, and lock your origin server so it only accepts traffic from Cloudflare. That last step is the one most often missed.
What a WAF does, and what it does not
A web application firewall looks at HTTP requests: the URL, headers, query strings, and request bodies. It can block common attack patterns such as SQL injection, cross-site scripting, and known exploit attempts against popular software, and it can challenge suspicious bots.
A WAF does not replace updates, strong passwords, or backups. If a plugin is vulnerable, the WAF may block known exploit patterns, but the plugin should still be updated. Think of the WAF as a filter in front of a well-maintained site, not a substitute for maintenance.
Step 1: Proxy your site through Cloudflare
Add your domain to Cloudflare and update nameservers at your registrar. In the DNS settings, make sure the records for your website show the orange cloud (proxied). Records set to DNS only bypass the WAF entirely.
Keep mail-related records, such as MX targets, as DNS only, since Cloudflare's standard proxy handles web traffic, not email.
Step 2: Configure SSL/TLS correctly
Set the SSL/TLS encryption mode to Full (strict). This requires a valid certificate on your origin server, which can be a free Let's Encrypt certificate or a Cloudflare Origin CA certificate. Avoid "Flexible" mode, which leaves the connection between Cloudflare and your server unencrypted and can cause redirect loops.
Also enable "Always Use HTTPS" and consider HSTS once you are confident everything works over HTTPS.
Step 3: Enable managed rules
Cloudflare maintains managed rulesets that are updated as new threats appear. Free plans include a free managed ruleset that covers high-impact, widely exploited vulnerabilities, while paid plans add the broader Cloudflare Managed Ruleset and the OWASP Core Ruleset. Enable what your plan includes, and review the security events log during the first days to confirm legitimate traffic is not being blocked.
Step 4: Add custom rules for sensitive paths
Custom rules let you act on specific conditions. Useful examples for a business website:
| Goal | Example approach |
|---|---|
| Protect the WordPress login | Managed Challenge on /wp-login.php unless from office IP |
| Protect admin areas | Block or challenge /wp-admin from outside expected countries |
| Block XML-RPC abuse | Block /xmlrpc.php if you do not use it |
| Stop known bad bots | Challenge requests with a low bot score (paid plans) |
A custom rule expression for the login page could look like this:
(http.request.uri.path eq "/wp-login.php" and not ip.src in {203.0.113.10})
with the action set to Managed Challenge. Replace the example address with your office's public IP. The number of custom rules available depends on your plan, so prioritize the most valuable ones.
Step 5: Rate limit forms and logins
Rate limiting rules restrict how many requests a single client can make to a path within a time window. Apply them to login pages, contact forms, password reset pages, and API endpoints. This slows brute-force attempts and form spam without affecting normal visitors.
Step 6: Lock down the origin server
If attackers can find your server's real IP address, they can bypass Cloudflare entirely. To prevent that:
- Configure the server firewall to accept HTTP and HTTPS only from Cloudflare's published IP ranges.
- Consider Authenticated Origin Pulls so your server only accepts connections presenting Cloudflare's client certificate.
- Check that old DNS records, mail headers, or subdomains do not expose the origin IP.
- If the origin IP was public before you moved to Cloudflare, consider changing it.
Also make sure your server logs show real visitor IPs by enabling Cloudflare's IP restoration at the web server level, so tools like fail2ban and Imunify360 act on the correct address.
Step 7: Know your emergency options
Bot Fight Mode helps against simple automated traffic, and Under Attack Mode adds a browser check for all visitors during an active attack. Use Under Attack Mode temporarily, since it adds friction for real users.
Our web hosting management service includes Cloudflare configuration with origin lockdown, and our cybersecurity services cover WAF tuning and monitoring.
FAQ
Is the free Cloudflare plan enough for a small business website?
For many small business sites, the free plan with proper configuration provides meaningful protection. Sites with higher risk, e-commerce, or compliance needs may benefit from the additional managed rules and bot features in paid plans.
Will Cloudflare WAF slow down my website?
Generally no. Cloudflare's network also caches static content, which often improves load times. Misconfigured rules can block legitimate visitors, which is why reviewing security events after changes matters.
Does the WAF protect my email?
No. Cloudflare's standard proxy protects web traffic. Email security depends on your mail provider and on SPF, DKIM, and DMARC records.
Next step
If your website is not behind a WAF yet, or you are not sure your origin is locked down, request a free IT assessment and we will review your Cloudflare and hosting setup.
