DDoS Protection with Cloudflare

Site protection against DDoS and bots with Cloudflare

Most "attacks" on stores are not targeted DDoS but aggressive scrapers and scanners working through admin URLs or downloading the catalogue. They are not trying to take the site down, but they generate load that does exactly that.

What I configure

• protection rules for critical sections: admin login, forms, search;
• request rate limits — so a scraper cannot pull the catalogue in a hundred parallel threads;
• distinguishing useful bots from harmful ones: search engines must work unobstructed;
• caching static assets at Cloudflare's edge to take load off the server;
• an elevated protection mode for use during an active attack;
• correct forwarding of the visitor's real IP address to the server — otherwise your logs show only Cloudflare addresses.

The main caveat

Protection rules break working things easily. The most common case: a rule blocks the payment provider's callback to your site, and payments stop being credited — money taken, order still unpaid. So callback URLs get explicit exceptions, and payment scenarios are tested after every change.

About the free plan

It is enough for most stores, but there is a limit on the number of custom rules. So the rules are written compactly: one well-constructed rule instead of five separate ones.