How to use Cloudflare's firewall rules to protect your website (2023)

For more than ten years,CloudflareThe team has provided security services to website builders worldwide and currently helps thousands of businesses maintain and protect their online resources.

Since its inception, Cloudflare has released many powerful firewall tools, such as IP Rules, CIDR Rules, ASN Rules, Country Rules, and HTTP User Agent Blocking, to name a few, and Cloudflare Firewall Rules is a recent addition. These rules combine the way firewall tools are used and give users more flexibility and control over how their firewall works.

In this article, you'll learn everything you need to know about firewalls, how to get started implementing and editing Cloudflare firewall rules on your site, and why security is so important.

What are the Cloudflare firewall rules?

Cloudflare firewall rules are a flexible and intuitive framework that website owners can use to filter HTTP requests – giving you full control over the requests that can reach your application.

Firewall rules integrate well with existing Cloudflare tools, allowing you to combine multiple techniques into a cohesive set of rules. For example, you can create a rule to block traffic from users that match a certain pattern, instead of having to use three or four different rules in as many places to achieve the same result.

They also give you the benefit of constantly monitoring website traffic and responding to threats accordingly. You can define expressions that tell Cloudflare what to do or not to do and what actions to take when those specific requests are fulfilled.

Why are firewalls necessary for your website?

Cloudflare is mainly used to reduce website loading speed and protect your website from online threats. It also fights spammers, malware injections and DDoS attacks.

About 70% of WordPress installationsare prone to hackers, making it more necessary to use a firewall from Cloudflare to protect your site from unwanted threats. Some of the reasons why firewalls are needed for your website are:

• Cloudflare uses three different types of minification, JavaScript, CSS, and HTML, to reduce file size and increase loading speed by removing unwanted spaces, line breaks, and unnecessary characters.
• With the introduction of HTTP/3, Cloudflare supports multiple page elements in parallel over a single TCP connection, along with push technology and header compression.
• Cloudflare WAF protects your website from many vulnerabilities that popular CMS tools (WordPress, Joomla, etc.) are prone to. Cloudflare WAF has more than 145 rules to protect your website from all types of web application attacks.
• Cloudflare has a rate limiting feature that helps mitigate DOS attacks, brute force login attempts, and other malicious intent targeting the application layer. The speed limiting feature allows you to configure limits, set responses and get information about web pages.

As you can see, Cloudflare not only improves SEO by speeding up your website, but also offers a wide range of advanced security features to protect your website from attacks.

Cloudflare Firewall Rules - Mapping and Actions

Cloudflare firewall rules consist of two main functions:Matching, which allows you to set a filter that exactly matches your traffic andActions, through which you specify the action Cloudflare will take after you set the appropriate filter.

Matching

Mapping allows you to filter incoming traffic to your site. If you e.g. want to restrict certain countries, redirect visitors to a site-specific page, or filter certain IP addresses, you will use match rules to do so.

Among the main features presented by Cloudflare areknown robotsfield (cf. client.bot). Gives you a Cloudflare approved list of good bots obtained from a reverse DNS lookup. You will find a comprehensive list of bots approved by sites like Google, Yahoo, Bing, Linkedin, Apple and more.

Note:Since the "allow input" feature has been removed, it is recommended to include cf.client.bot inAllowedThe rule. This will prevent Cloudflare's firewall rules from inadvertently blocking good crawlers.

In addition, Cloudflare firewall rules also come with an algorithm that providesthreat resultIPs by measuring their online reputation. The threat rating goes from 0 to 100 and is divided into the following categories:

• High – for scores from 0 to 13.
• Medium – for results from 14 to 23.
• Low – for results from 24 to 48.
• Mainly turned off – for scores above 49.

But simply establishing matching rules won't accomplish much. This is where the actions come in.

Actions

By setting the appropriate filters, you can instruct Cloudflare firewall rules to apply standard Cloudflare actions (block,JavaScript challenge, dvsChallenge) as well as the new oneAllowhandling.

• Block: Used to block traffic from accessing your web application.
• JavaScript challenge: Used to block traffic from non-JavaScript visitors, which are usually bots.
• Challenge (Captcha): used to set aCaptchachallenge of blocking potential bots.
• Allow: Used to grant visitors access to your web application.

Three examples of Cloudflare firewall rules in action

In this section, you will find three ways to configure Cloudflare firewall rules using the dashboard and why it can be useful.

We will cover:

• How to block certain countries from visiting your site
• How to make your WordPress site more secure with captcha
• How to prevent bad bot traffic from entering your site

Note: Another way to configure these rules is to useAPIITerraform.

To get started, log in to the Cloudflare dashboard. From there, select the domain name for which you want to set Cloudflare firewall rules.

Then click onVatrozidfrom the upper parts onwardsPravila vatrozida.

This section allows you to set a new firewall rule, view and filter existing rules, enable, disable, modify and delete rules. To try the examples below, clickCreate a firewall rule.

Example 1 – Blocking all countries except the US

To exclude all countries except one (in our example it will be the US), follow these steps:

1. First, give your rule a name.
2. FromMarkdrop-down menu, selectThe earth.
3. Then offOperatordrop-down menu, selectis not equal.
4. uvaluedrop-down menu, select itUnited States.
5. Finally chooseIn actiondrop-down menu, selectBLOCK,and then click the blue oneDevelopbutton in the lower right corner.

Conversely, if you want to exclude an individual country, select iton the equivalentfromOperatordrop-down menu, and then follow the procedure above.

Expression Editor:

(ip.geoip.country not "USA")

Example 2 – WordPress security

WordPress security is an important thing that website owners don't think too much about. Weekday,Google blacklistsaround 10,000+ sites for malware and around 50,000+ pages each week for phishing. It is important to protect your WordPress site from malware and threats and avoid site bans.

Why is WordPress Security Important?

Whether your site is large or small,hackers don't care. One way or another, they can find different ways to use the information against you. They usually ask for your personal and financial information and then use the collected information to try to harm you and your business.

Mark Ronso, Director of Marketing atReviews by top authors, he said, "a compromised website can seriously damage a company's reputation. Hackers typically install malware or viruses to extract data in the background, which can result in a loss of trust in your company and customers switching to a competitor."

Therefore, to keep your business safe and secure, protect your website with WordPress plugins or Cloudflare firewall. So which is better and what is the difference between the two?

WordPress Plugins vs Cloudflare Firewall – Which is Better?

Many people choose to install free plugins to manage their website security rather than having to use a third-party tool like Cloudflare – usually because it's too complicated or to save money. In fact, Cloudflare doesn't take long to install and gives you much more functionality than any other WordPress plugin.

Here are the key differences you should know:

Vatrozid Cloudflare:

• Cloudflare Firewall integrates seamlessly with CDNs like WordPress
• Cloudflare's Automatic Platform Optimization (APO) caches your site and optimizes components, increasing your site's speed.
• Cloudflare firewall offers free SSL certificate and DNS service along with strong DDoS protection.
• It increases the speed and performance of your website by dynamically rewriting insecure URLs to their secure copies.
• Free to start

WordPress Security Plugins:

• It regularly scans your website for malicious code and has a real-time firewall feature that protects your website from known and unknown threats.
• Many free plugins do not offer features like IP blocking, country blocking, and brute force connection protection.
• Some WordPress plugins allow you to rename the login portal to avoid possible attacks.
• You never know what permissions you give the plugin developer.

All things considered, most WordPress plugins don't speed up your site or offer as many advanced features as Cloudflare's firewall. Cloudflare firewall is recommended through free security plugins to protect your site from any attacks.

How to protect your WordPress site with Cloudflare's firewall

Repeat the process above to create a new firewall rule and name it, but this time clickEdit the expression.

This way you have direct accessExpression editor. Insert the following into the field:

((http.request.uri.path contains "/xmlrpc.php") or (http.request.uri.path contains "/wp-login.php") or (http.request.uri.path contains "/wp- admin/", not http.request.uri.path contains "/wp-admin/admin-ajax.php", not http.request.uri.path contains " /wp-admin/theme-editor.php")) and ip.geoip.country not "USA"

Then selectChallenge (Captcha)fromChoose an actiondrop-down menu, and then clickDevelop.

You have now created a Captcha challenge for all non-US visitors trying to access WordPress xmlrpc.php, wp-login.php and /wp-admin (except admin-ajax.php and theme-editor.php) , to block potential hackers from accessing your WordPress site.

If the login or admin URLs have changed, you can edit the original expression to match.

Example 3 – Blocking bad bot traffic

Bad bots have been assigned to carry out a variety of fraudulent practices and malicious activities such as ad fraud, malware attacks and data theft. Eye40% of internet trafficconsists of bad bot traffic, and during the pandemic there was one788% increase in bad bot trafficat retail locations worldwide between September and October 2020, resulting in a loss of $82 million during the peak period.

Blocking bad traffic helps prevent attackers from trying to launch a DDoS attack on your site. Most DDoS attacks slow down your website by directing a large amount of traffic to your website, overloading the server and taking it offline.

The procedure is similar to the previous example. The only difference is that you have to chooseblockfromChoose an actiondrop-down menu and paste the following into the expression editor:

(http.user_agent contains "Yandex") or (http.user_agent contains "muckrack") or (http.user_agent contains "Qwantify") or (http.user_agent contains "Sogou") or (http.user_agent contains "BUbiNG") or (http.user_agent contains "knowledge") or (http.user_agent contains "CFNetwork") or (http.user_agent contains "Scrapy") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "AhrefsBot") or (http.user_agent contains "Baiduspider") or (http.user_agent contains "python-requests") or (http.user_agent contains "crawl", not cf.client.bot) or (http.user_agent contains "Crawl", and not cf .client.bot) or (http.user_agent does not contain "bot" http.user_agent does not contain "bingbot" http.user_agent does not contain "Google" http.user_agent does not contain "Twitter" cf client.bot) or (http. user_agent contains "Bot" not http.user_agent contains "Google" not cf.client.bot) or (http.user_agent contains "Spider" not cf. .client.bot ) or (http.user_agent contains "spider" " "not cf .client.bot)

This rule will block bot traffic with user agents containing the strings "crawl", "bot", "spider" and some other custom user agents.

You can rewrite the same rule using nested parentheses as follows:

(http.user_agent contains "Yandex") or (http.user_agent contains "muckrack") or (http.user_agent contains "Qwantify") or (http.user_agent contains "Sogou") or (http.user_agent contains "BUbiNG") or (http.user_agent contains "knowledge") or (http.user_agent contains "CFNetwork") or (http.user_agent contains "Scrapy") or (http.user_agent contains "SemrushBot") or (http.user_agent contains "AhrefsBot") or (http.user_agent contains "Baiduspider") or (http.user_agent contains "python-requests") or ((http.user_agent contains "crawl") or (http.user_agent contains "Crawl") or (http.user_agent contains "bot " " and not http.user_agent contains "bingbot" and not http.user_agent contains "Google" and not http.user_agent contains "Twitter") or (http.user_agent contains "Bot" and not http .user_agent contains "Google ") or ( http.user_agent contains "Spider") or (http.user_agent contains "spider"), not cf.client.bot)

How to check if your firewall rules are working

After you finish the setup, you should check if Cloudflare's firewall rules are working. To do this, you can gain accessDnevnik activitere vatrozidawith return toreviewpart of the firewall. There you can see a list of firewall events and details related to them.

Note that checking firewall rules may take some time if you do not have a lot of traffic. If this is the case, wait a few days and monitor Google Analytics to make sure there are no anomalies before returning to Cloudflare and checking the activity log.

The most important thing to be aware of ischallengeIblockevents.

whenchallengeIblockevents appear in the list, take a moment to read them and see if any good bots were blocked when they shouldn't have been, or if any known bad bots got through. You must ensure that no positive traffic is denied access to your site due to an error while setting up firewall rules.

Summary – Use Cloudflare firewall rules to your advantage

RunCloud allows you to easily manage your server and web application and integrates seamlessly with Cloudflare. We hope you found this guide useful for setting up and effectively applying Cloudflare firewall rules to improve the security and performance of your web application.

Get started with RunCloud today.

What firewall rules are you currently enforcing through Cloudflare? Let us know and join the conversation in the comments below! 💬

Categories:Self-study,Security,Serverstyring,