Cloudflare WAF Rules Generator

1

Allow Good Bots Skip / Allow

Grants unrestricted access to the bot categories you approve. Cloudflare does an excellent job classifying legitimate bots - this rule simply tells it which categories to let through without challenge. Let's Encrypt is always included so SSL renewals never get blocked.

lock Always included: Let's Encrypt ACME challenge

Web Server IP Optional

tips_and_updates Since later rules block many hosting providers, add your web server's IP here to prevent blocking your own server's CRON jobs and outbound connections. Your server typically has both an IPv4 and IPv6 address - add both if possible, separated by a comma. If provided, they will be included as an Allow condition using IP Source is in in the Rule 1 expression.

2

Aggressive Crawlers Managed Challenge

Targets overly persistent bots that hammer your server. This rule effectively stops most fake bots, but note that it will also catch aggressive SEO crawler tools. If you use a service like SEMrush or Ahrefs for your own site, uncheck it below so you don't block your own scans.

warning_amber Important: For this rule to actually catch Ahrefs, SEMrush, and similar tools, two things must be true: (1) make sure "Search Engine Optimization" is NOT checked in Rule 1 above, and (2) uncheck "All remaining custom rules" in your Allow Good Bots rule inside Cloudflare. Without both of those, the Allow rule will override this one. Be cautious when adjusting the Allow rule settings as removing too many exceptions can inadvertently block legitimate services.

3

Challenge Large Providers / Country Managed Challenge

Hackers and spammers frequently spin up VPS servers on Google Cloud, Amazon EC2, and Azure to launch rapid attacks or waste resources scanning your site. These servers can stay active for days. This rule issues a managed challenge to that traffic. Optionally, you can also challenge visitors from outside your primary country, which cuts off a large percentage of automated threats before they ever touch your site.

Country Restriction

Enable Country Restriction

Challenge visitors from outside your target country. Recommended for local or regional businesses.

Allowed Country / Region

Allow Facebook Traffic

Allows traffic arriving via Facebook links (fbclid parameter). Recommended if you run Facebook ads or share links on Facebook.

tips_and_updates Third-party services: Legitimate services do run on AWS, Azure, and Google Cloud. If you use a third-party tool that needs to connect to your site from one of these providers, you may need to whitelist their IP in the Allow Good Bots rule. That said, Cloudflare's Verified Bots list already covers many of these services, so you may not need to do anything extra.

VPS Providers to Challenge

lock Amazon AWS / EC2ASN 7224, 16509, 14618

lock Microsoft AzureASN 8075

lock Google CloudASN 396982

4

Block VPN / Web Host / Paths / TOR Managed Challenge

This rule combines VPN providers, a compiled list of web hosting ASNs I have built up over years of identifying attack sources, TOR exit nodes, and requests to vulnerable WordPress paths. While legitimate users do use VPNs and TOR, the volume of malicious traffic from those sources far outweighs the benefit of allowing them freely. For eCommerce sites in particular, blocking these sources has significantly reduced fraud. By merging these into one rule, it also frees up a rule slot so you can use Cloudflare's native AI Scraping Protection.

WordPress Paths

WordPress Site

Blocks xmlrpc.php, wp-config.php, wlwmanifest, and wp-login.php - the most common WordPress attack targets.

Additional Blocking

Block AI Crawlers

Blocks "AI Crawler" and "Other" from Cloudflare's verified bot list. Disable if you are using Cloudflare's native AI Scraping Protection or want AI tools to index your site.

Block TOR Exit Nodes

Blocks all TOR network traffic (country code T1). Recommended unless you specifically need to serve TOR users.

info The combined ASN list covers both major VPN providers and web hosting services compiled from years of identifying attack sources. On rare occasions a user might be on a custom VPN through a provider like DigitalOcean or phoenixNAP and hit this rule. It's uncommon, but it does happen.

tips_and_updates VPNs: Legitimate users do use VPNs, but so do hackers and spammers. In my experience, the negative impact from malicious VPN traffic far outweighs the benefit of allowing it freely, so I issue a managed challenge rather than blocking outright.

tips_and_updates TOR: I do not allow TOR or TOR exit nodes. Legitimate users may use TOR, but so do bad actors. I prefer to block them entirely. If you block TOR here, I also recommend turning off Onion Routing in Cloudflare under Network settings.

tips_and_updates WordPress login tip: I also recommend setting up Cloudflare Access as an extra layer of protection for your WordPress login page. It is free for up to 50 users per Cloudflare account.

storefront eCommerce: For online stores, blocking VPNs and TOR has made a significant difference. One of my largest clients runs an eCommerce site and their fraud incidents decreased substantially after we implemented these rules.

WAF Rules Customizer

Your Custom WAF Rules