When your domain uses Cloudflare as a proxy (orange cloud), every request passes through Cloudflare first. Its web application firewall (WAF) can block or challenge unwanted traffic at the edge, so attacks never reach your MdmHost server and do not use your account's resources.
Before you start
- A domain added to Cloudflare with its DNS records set to Proxied.
- SSL set to Full (strict); see Cloudflare Full (strict) SSL.
- Custom rules are available on the free plan with a limited number of rules; managed rulesets need a paid plan.
Open the WAF
- Log in to the Cloudflare dashboard and choose your domain.
- Go to Security → WAF → Custom rules.
- Click Create rule. Each rule has a name, an expression (when it matches) and an action.
Actions you will use most:
| Action | Effect |
|---|---|
| Block | Visitor gets a Cloudflare block page. |
| Managed Challenge | Cloudflare decides whether to show a check; humans usually pass automatically. |
| Skip | Let matching traffic bypass other rules, for example your office IP. |
Useful rules
Protect the WordPress login
Use Edit expression and paste:
(http.request.uri.path contains "/wp-login.php") or (http.request.uri.path contains "/xmlrpc.php")Action: Managed Challenge. This stops most brute-force bots. More options are in protect wp-login and XML-RPC.
Allow your own IP first
(ip.src eq 203.0.113.10)Action: Skip all remaining custom rules, and place this rule at the top of the list.
Block countries you never serve
(ip.src.country in {"XX" "YY"})Replace the codes with two-letter country codes. Prefer Managed Challenge over Block if real customers could travel.
Block common exploit paths
(http.request.uri.path contains "/.env") or (http.request.uri.path contains "/.git")Action: Block.
Warning: Do not challenge /wp-admin/admin-ajax.php, /wp-cron.php, payment gateway callbacks or API endpoints. Machines cannot solve challenges, so those features would break.
Check afterwards
- Open Security → Events to see which rule matched each request, and adjust rules that catch real visitors.
- Because visitors now arrive from Cloudflare IPs, make sure your server logs the real visitor IP. On LiteSpeed servers this is handled automatically; on Nginx see Nginx real IP behind Cloudflare.
- An attacker who knows your server IP can bypass Cloudflare. Do not publish it in DNS records such as an unproxied
directA record.