Cloudflare WAF Rules V3: Enhancing Your Website Security
Five battle-tested Web Application Firewall (WAF) rules by Web Agency Hero to protect your website from spam bots, scrapers, and attacks without needing an Enterprise plan.
Overview
Version 3 of the Web Agency Hero WAF rules was specifically designed around the limits of Cloudflare's free plan (up to 5 custom rules). It is suitable for most CMS platforms (including WordPress) and helps block up to 95% of junk traffic before it even hits your server.
Firewall Ruleset
Allows legitimate search bots (Google, Bing, Yandex) and trusted services/server IP.
(cf.client.bot) or (http.user_agent contains "Uptime-Kuma") or (ip.src in {YOUR_SERVER_IP})Blocks or challenges aggressive SEO scrapers (Ahrefs, Semrush, MJ12) and spam bots.
(http.user_agent contains "AhrefsBot") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "MJ12bot") or (http.user_agent contains "DotBot") or (http.user_agent contains "Bytespider")
Issues a Managed Challenge to requests originating from cloud hosting, VPNs, or foreign countries.
(ip.geoip.asnum in {16509 14061 24940 63949} and not cf.client.bot) or (not ip.geoip.country in {"US" "RU" "UA" "KZ"})Hard blocks access to vulnerable paths (wp-config.php, .env) and TOR traffic.
(http.request.uri.path contains "wp-config.php") or (http.request.uri.path contains ".env") or (http.request.uri.path contains "/xmlrpc.php") or (ip.geoip.asnum in {TOR_ASNS})Additional routing optimization and mandatory disabling of TOR Onion Routing.
(http.host contains ".onion") or (ip.src eq YOUR_SERVER_IP)