Cloudflare Web Application Firewall WordPress 6.x

How to Set Up Cloudflare WAF for WordPress

Step-by-step guide to configuring Cloudflare Web Application Firewall to protect your WordPress site from attacks.

15-30 minutes beginner 7 steps
Last updated: Jul 18, 2026

Cloudflare's WAF provides excellent protection for WordPress sites against common attacks like SQL injection, cross-site scripting (XSS), and brute force login attempts.

This guide walks you through the complete setup process, from adding your domain to Cloudflare to configuring WordPress-specific security rules.

Prerequisites

  • A WordPress website hosted on any web server
  • Access to your domain registrar to change nameservers
  • A Cloudflare account (free tier works) Learn more

Step-by-Step Guide

1

Add Your Domain to Cloudflare

Log into your Cloudflare dashboard and click "Add a Site". Enter your domain name (without www) and click "Add Site".

Cloudflare will scan your existing DNS records. Review them to ensure all your subdomains and mail records are included.

Tip: Make sure your WordPress site's A record is listed and set to "Proxied" (orange cloud icon).
2

Update Your Nameservers

Cloudflare will provide you with two nameservers. Log into your domain registrar and replace your current nameservers with the Cloudflare ones.

DNS propagation can take up to 24 hours, but usually completes within a few hours.

Warning: Do not delete your old DNS records until the new nameservers are active.
3

Configure SSL/TLS Encryption

Before enabling the WAF, set a secure encryption mode so traffic is protected end to end:

  1. Go to SSL/TLS > Overview and set the encryption mode to Full (Strict).
  2. Full (Strict) requires a valid TLS certificate on your origin server. If your host does not already provide one, install a free certificate: use Let's Encrypt, or generate a Cloudflare Origin CA certificate under SSL/TLS > Origin Server > Create Certificate and install it on your origin.
  3. Use Full (without Strict) only as a short interim step while you provision a trusted certificate.
Warning: Do not use Flexible mode. Cloudflare's own docs state that "if your application contains sensitive information (personalized data, user login), use Full or Full (Strict) modes instead." Every WordPress site exposes wp-login.php and wp-admin, so Flexible leaves the Cloudflare-to-origin connection unencrypted and can cause redirect loops.
4

Enable Cloudflare WAF

Once your domain is active on Cloudflare, deploy the managed rulesets:

  1. Go to Security > Settings and filter by "Web application exploits" (in the legacy dashboard: Security > WAF > Managed rules).
  2. Turn on the Cloudflare Managed Ruleset.
  3. Optionally turn on the Cloudflare OWASP Core Ruleset. It is prone to false positives, so tune it before you let it block traffic.

To tune the OWASP ruleset, select the Cloudflare OWASP Core Ruleset from the managed rules list to open its configuration, then set the OWASP Paranoia Level (PL1-PL4), the OWASP Anomaly Score Threshold (Low, Medium, or High), and the OWASP Action (Log, Block, or a challenge). Start at PL1 with the action set to Log, then raise the sensitivity gradually while watching for false positives.

Tip: Start with the WAF in "Log" mode for a few days to see what requests would be blocked before switching to "Block" mode.
5

Configure WordPress-Specific Rules

Create custom rules to protect WordPress-specific endpoints:

  1. Go to the Security rules page and select "Create rule", then "Custom rules" (in the legacy dashboard: Security > WAF > Custom rules).
  2. Create a rule to protect wp-login.php from brute force attacks.
  3. Consider blocking access to xmlrpc.php if not needed.
  4. Select "Deploy" to activate the rule.
text 
# Block xmlrpc.php (if you don't use it)
Rule Name: Block XML-RPC
Expression: (http.request.uri.path eq "/xmlrpc.php")
Action: Block
6

Install Cloudflare Plugin (Optional)

Install the official Cloudflare WordPress plugin for better integration:

  1. Go to Plugins > Add New in WordPress
  2. Search for "Cloudflare"
  3. Install and activate the official Cloudflare plugin
  4. Connect it with your Cloudflare API token
Tip: The plugin is optional. It enables one-click cache purging, but you do not need it to recover real visitor IPs: Cloudflare always sends the original client address in the CF-Connecting-IP header. Read it at the origin with Apache's mod_remoteip (RemoteIPHeader CF-Connecting-IP), Nginx's ngx_http_realip_module (real_ip_header CF-Connecting-IP), or by enabling Cloudflare Managed Transforms ("Add visitor location headers" / true-client-ip).
7

Test Your Configuration

After setup, test that your site works correctly:

  • Visit your site and verify it loads properly
  • Test logging into WordPress admin
  • Check that comments and forms still work
  • Monitor the Cloudflare dashboard for any blocked requests

Conclusion & Next Steps

Your WordPress site is now protected by Cloudflare's WAF. The managed rulesets will automatically block most common attacks, and your custom rules provide additional WordPress-specific protection.

Next steps:

  • Review blocked threats regularly on the Security > Events page (Security > Analytics in the newest dashboard)
  • Consider upgrading to Cloudflare Pro for additional WAF features
  • Enable Bot Fight Mode for additional bot protection

Troubleshooting

Site shows SSL errors

In Cloudflare's SSL/TLS settings, set the encryption mode to Full (Strict). This requires a valid TLS certificate on your origin server. If your host does not provide one, install a free certificate: use Let's Encrypt, or generate a Cloudflare Origin CA certificate under SSL/TLS > Origin Server > Create Certificate. Full (without Strict) is acceptable only as an interim step while you provision a trusted certificate. Do not fall back to Flexible mode, which leaves the origin connection unencrypted and is unsafe for sites with a login.

Forms or login not working

Check Security > Events for blocked requests. You may need to create an exception (skip) rule for legitimate traffic.

Site is slow after setup

Enable Cloudflare's caching features and consider enabling Rocket Loader for JavaScript optimization.

Frequently Asked Questions

Is Cloudflare WAF free?

Yes, the basic Cloudflare WAF is included in the free plan. It includes managed rulesets that protect against common attacks. More advanced features like additional custom rules and detailed analytics are available on paid plans.

Will Cloudflare slow down my WordPress site?

No, Cloudflare typically makes WordPress sites faster by caching static content and serving it from edge locations closer to your visitors. The WAF inspection adds minimal latency (usually less than 1ms).

Related Guides

How to Configure AWS WAF with Application Load Balancer

Learn how to protect your AWS applications by attaching AWS WAF to an Application Load Balancer with managed rule groups.