Cloudflare WAF is the first line of defence for any online store. This guide covers the practical side: custom rules, rate limiting and bot protection.
Baseline custom rules
Start by blocking suspicious user agents and the regions you have no customers in. Expression rules do the job:
(http.user_agent contains "python-requests") or
(ip.geoip.country in {"RU" "BY" "KP"})
Protecting the admin panel
Lock down /wp-admin, /admin and /administrator with Cloudflare Access or an IP allowlist. That alone removes about 90% of brute-force traffic against the admin.
Rate limiting
Apply rate limiting to the checkout and login pages: no more than 10 requests per 60 seconds from a single IP. This is what stops credential stuffing.
Bot Fight Mode
Turn on Super Bot Fight Mode — it blocks known malicious bots automatically while keeping the useful ones (Google, Bing) coming through.
L7 DDoS protection
When /wp-login or /checkout is under attack: switch to Under Attack Mode temporarily and add an expression rule that challenges all traffic to those URLs.
