Cloudflare’s firewall sits in front of your site entirely, filtering traffic before it ever reaches your server — which means a properly configured rule set can block an attack before it costs your server any resources at all, rather than your site absorbing the request and then deciding what to do with it.
Cloudflare WAF rule configuration
Cloudflare's firewall configured to filter attacks before they reach your server at all.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Access to your Cloudflare account with the relevant domain configured
- Confirmation of any legitimate traffic patterns Cloudflare might otherwise flag (specific bots, integrations, regions)
- Your tolerance for strictness versus the risk of blocking legitimate visitors
This or something else?
| You want Cloudflare’s own firewall rules configured for your domain | This fix covers it |
| You want a WordPress plugin-based firewall instead, not Cloudflare specifically | Firewall (WAF) plugin configuration, the plugin-level version |
| You’re not on Cloudflare yet and need it set up from scratch, DNS and all | A larger, related setup beyond just firewall rules |
| You want SSL/TLS configuration improved on Cloudflare, a different, related fix | SSL/TLS configuration grade improvement |
What we do
- Review your current Cloudflare configuration and traffic patterns
- Configure firewall rules covering common attack patterns and known bad actors
- Whitelist confirmed legitimate traffic that might otherwise be affected
- Set an appropriate security level balancing protection against false positives
- Test that normal site traffic passes through unaffected
- Document the rule set and how to review blocked traffic later
What is included
- Configured, tested Cloudflare firewall rules
- Whitelisting of confirmed legitimate traffic
- Verification normal traffic is unaffected
- A written note on the configuration and how to review activity
Not included
- Setting up Cloudflare from scratch if not already in use, a larger, separate task
- A WordPress plugin-level firewall, a separate, complementary layer
- Ongoing rule tuning as new threats emerge
- SSL/TLS certificate configuration, a related but separate fix
Questions about this fix
Do I need a paid Cloudflare plan for this to be worthwhile?
Meaningful firewall protection is available on Cloudflare's free tier — paid plans add more advanced rule options, but we configure effectively within whichever tier you're on.
Will this replace needing a WordPress security plugin?
Not entirely — Cloudflare filters traffic before it reaches your server, which is a strong first layer, but a security plugin still covers things happening once traffic is already inside WordPress.
Could strict firewall rules block legitimate visitors from certain countries or networks?
It's possible with overly broad rules, which is why we configure based on your actual known traffic rather than a generic, one-size-fits-all rule set.
How is this different from Cloudflare's default protection?
Cloudflare's defaults offer a baseline, but deliberately configured rules tuned to your specific site and traffic offer meaningfully stronger, more relevant protection than leaving defaults untouched.
Will I be able to see what the firewall is actually blocking?
Yes, Cloudflare provides activity logs, and we document how to review them so this isn't a black box you have to trust blindly.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.