---
title: Recommended Cloudflare security settings for WordPress
description: "The Cloudflare settings and WAF rules we recommend to block automated WordPress attacks without getting in your visitors' way."
url: "https://staging-learn.web7tech.com/docs/recommended-cloudflare-security-settings-for-wordpress/"
updated: "2026-10-19"
category: "Cloudflare & DNS"
tags:
  - Cloudflare
  - Security
  - WordPress
---

# Recommended Cloudflare security settings for WordPress

Your Web7 VPS already sits behind our Quad Firewall: four layers, each from a different vendor. If you use your own Cloudflare account, these settings add a fifth layer at the edge. Together they block the vast majority of automated WordPress attacks without getting in your visitors' way.

> This guide assumes your domain is already active on Cloudflare with SSL set to **Full (strict)**. If not, start with [Connect your domain to Cloudflare](/docs/connect-your-domain-to-cloudflare/).

## 1. Baseline settings

| Setting | Where in Cloudflare | Recommended |
| --- | --- | --- |
| **SSL/TLS encryption** | SSL/TLS → Overview | Full (strict) |
| **Always Use HTTPS** | SSL/TLS → Edge Certificates | On |
| **Minimum TLS Version** | SSL/TLS → Edge Certificates | TLS 1.2 |
| **Browser Integrity Check** | Security settings | On |
| **Bot Fight Mode** | Security settings | Off for most sites (see below) |

> **About Bot Fight Mode:** it can't be bypassed with rules, so it sometimes blocks things you want, such as uptime monitors, payment gateway webhooks (Stripe, PayPal) and Jetpack. Use the WAF rules below instead. They do the same job more precisely.

## 2. Challenge visitors to the login page

Create a WAF custom rule (**Security → WAF → Custom rules**) named **Protect WordPress login**, and use **Edit expression** to paste:

```
(http.request.uri.path eq "/wp-login.php")
or (starts_with(http.request.uri.path, "/wp-admin/")
    and http.request.uri.path ne "/wp-admin/admin-ajax.php")
```

Set the action to **Managed Challenge**. Real people pass it in a second or two, while bots don't. The `admin-ajax.php` exception matters because many plugins use it on the public side of your site.

**Even tighter:** if everyone who logs in is in one country, add `and ip.src.country ne "US"` (with your own country code) to the expression and change the action to **Block**.

## 3. Block XML-RPC

XML-RPC is an old remote-publishing interface that's mostly used for brute-force attacks today. Add a second rule:

```
(http.request.uri.path eq "/xmlrpc.php")
```

Action: **Block**. Skip this rule if you use Jetpack or the WordPress mobile app, which still rely on it.

## 4. Rate-limit login attempts

Under **Security → WAF → Rate limiting rules**, create a rule that matches:

```
(http.request.uri.path eq "/wp-login.php" and http.request.method eq "POST")
```

Count requests per IP address, block when one IP goes over 5 requests in 10 seconds, and block for 10 seconds. On the Free plan the period and block time are fixed at 10 seconds. That's still enough to break up brute-force bursts.

## 5. Block common probes

Bots constantly scan for leaked configuration files. Nothing legitimate requests these paths, so block them outright:

```
(http.request.uri.path contains "/.env")
or (http.request.uri.path contains "/.git")
or (http.request.uri.path contains "wp-config.php")
```

## 6. Leave admin pages out of the cache

By default, Cloudflare doesn't cache your HTML pages. If you turn on **Cache Everything** or Automatic Platform Optimization, make sure `/wp-admin/`, `/wp-login.php`, and requests carrying the `wordpress_logged_in` cookie bypass the cache. On WooCommerce stores, also bypass the cart, checkout and account pages.

## Test before you rely on it

- Open your site and your login page in a private window to check the challenge appears only where you expect.
- Watch **Security → Events** for a day or two. If a service you rely on is being blocked, add a skip rule for it rather than switching the protection off.
- Payment gateways call back to URLs like `/?wc-api=`. Make sure no rule challenges those requests.

Prefer not to manage this yourself? [Ask us](https://my.web7tech.com/submitticket.php) about routing your domain through Web7's Cloudflare protection with a single `CNAME`.