Cloudflare WAF for an Online Store: A Practical Guide

Cloudflare WAF is the first line of defence for any online store. This guide covers the practical side: custom rules, rate limiting and bot protection.

Baseline custom rules

Start by blocking suspicious user agents and the regions you have no customers in. Expression rules do the job:

(http.user_agent contains "python-requests") or 
(ip.geoip.country in {"RU" "BY" "KP"})

Protecting the admin panel

Lock down /wp-admin, /admin and /administrator with Cloudflare Access or an IP allowlist. That alone removes about 90% of brute-force traffic against the admin.

Rate limiting

Apply rate limiting to the checkout and login pages: no more than 10 requests per 60 seconds from a single IP. This is what stops credential stuffing.

Bot Fight Mode

Turn on Super Bot Fight Mode — it blocks known malicious bots automatically while keeping the useful ones (Google, Bing) coming through.

L7 DDoS protection

When /wp-login or /checkout is under attack: switch to Under Attack Mode temporarily and add an expression rule that challenges all traffic to those URLs.