01 · The gap
What a default Cloudflare install misses.
Out of the box, Cloudflare proxies your traffic and absorbs volumetric attacks. Here is what it does not do.
- •Apply any WordPress-specific rules. XML-RPC stays open, wp-login.php has no rate limit, and .env, .git and .sql files are still reachable if they exist.
- •Distinguish between a crawler you want and one you do not.
- •Know which of your pages must never be cached, which is how sites end up serving expired form tokens and breaking every submission.
- •Tell you whether any of it is actually working, because nobody captured a baseline.
Most sites we inherit have Cloudflare installed in exactly this state, sometimes for years, and the owner reasonably assumes they are protected. Closing that gap is the core of our WordPress security work.
02 · Foundation
The account, the DNS and the certificate.
Account and plan setup
Pro plan activation, billing configuration, and access set up so your team owns the account and we are invited into it rather than the other way round.
OwnershipYou keep control. If we stop working together you remove our access and nothing changes.
DNS migration
Every existing record is inventoried before anything moves. A records, CNAMEs, MX and TXT records all have to come across intact, and the MX and TXT records are where migrations go wrong: get those wrong and you break email and domain authentication rather than the website. We verify propagation before declaring it done.
SSL and TLS policy
SSL mode set to Full (Strict), minimum TLS version enforced at 1.2, HSTS enabled, automatic HTTPS redirect on.
VerifiedThe target is an A+ on an independent SSL test, and we check it rather than assume it.
03 · Filtering
Where site-specific knowledge earns its keep.
Managed rulesets
The Cloudflare Managed Ruleset and the OWASP Core Ruleset both activated, plus the platform-specific ruleset for WordPress.
RuleThen the part most people skip: a false positive pass, where sensitive rules start in log mode and only move to block once we have confirmed they are not catching legitimate traffic.
Rate limiting
Four rules, not one. A general site-wide rule, a brute force rule on the login page, a rule for API endpoints, and a rule covering the admin panel.
RuleEach one is tested individually, because a rate limit that fires on your own team is a support ticket waiting to happen.
Custom WAF rules
Malicious user agent blocking. Empty user agent blocking. Sensitive file extension blocking for .env, .git, .sql and .bak. XML-RPC blocking, which closes off one of the most-abused endpoints in WordPress. Suspicious URI pattern blocking for path traversal and injection attempts. IP restriction on the admin panel where the working arrangements allow it.
Geographic policy
Where the business only serves certain markets, restricting access to those markets removes an enormous amount of attack surface for no commercial cost.
RuleRules are tested from multiple countries via VPN before they go live, because a geo rule that is wrong is invisible until a customer in the wrong place cannot reach you.
04 · Performance
Caching is where a WordPress site most often breaks.
General caching, an aggressive rule for static assets, and explicit bypasses for login pages, checkout pages and any page with a dynamic form on it. That last item is not optional.
WordPress uses one-time tokens to secure form submissions, and a cached page serves a stale token to every subsequent visitor, which means the form fails for real users while working perfectly when you test it logged in.
The full explanation of that failureImages
Image and mobile optimization
Polish for image compression with WebP conversion, and Mirage for mobile. Image quality is verified visually rather than trusted to the setting.
Bandwidth
Hotlink protection and email obfuscation
Small items, but they stop other sites serving images off your bandwidth and stop scrapers harvesting addresses out of your markup.
05 · Hardening and handover
Nothing is finished until it is verified in a browser.
Security headers
X-Frame-Options set to DENY, X-Content-Type-Options set to nosniff, a Referrer-Policy and a Permissions-Policy, all verified in a browser rather than assumed from the config screen.
Page and transform rules
Forced HTTPS, canonical www or non-www handling, and any custom redirects the site needs preserved.
Baseline analytics
A firewall analytics report pulled 24 to 48 hours after go-live, documenting what percentage of traffic is being blocked and which rules are firing.
RuleWithout this you have no way of knowing whether the work did anything.
Full site testing
Every page loads, every form submits, payment flows complete without false blocks, mobile renders correctly, and page speed is measured before and after.
Documentation
Every rule applied, written down. A dashboard guide so your team can read the analytics without us. And an emergency procedure covering what to do during an attack.
This is one piece of our wider WordPress security work. Once the configuration is handed over, keeping it current sits with our maintenance service.
Common questions
Do I need Cloudflare Pro or will the free plan do?+
The free plan covers DDoS mitigation and basic filtering, which is adequate for a brochure site. Pro adds the managed WAF rulesets, shapeable rate limiting, firewall analytics and the bot controls that let you block one crawler while allowing another. If your site takes applications, orders or payments, or talks to another system by API, Pro is the right plan and the annual cost is trivial next to the work of configuring it.
Will this slow my site down?+
No, it normally speeds it up. Cloudflare serves cached assets from an edge location near the visitor rather than from your origin server, and the image optimization reduces payload further. We measure page speed before and after as part of the handover so you can see the effect rather than take our word for it.
Can you configure Cloudflare on a site you did not build?+
Yes, most of this work is on sites built by someone else. We need read access to the site and admin access to the Cloudflare account. We do not need to touch your theme or your code.
Who owns the Cloudflare account?+
You do. We ask to be invited as a member on your account. If we stop working together you remove our access and everything stays exactly as configured.
What if a rule blocks a real customer?+
That is what the false positive pass and the log-first approach are for, and it is why the sensitive rules are tested before they are set to block. If something does slip through after handover, the documentation tells you which rule to look at, and any rule can be disabled from the dashboard in seconds.
Does this replace my security plugin?+
Largely, yes, and that is usually a performance win. A plugin-based firewall filters requests after WordPress and PHP have already loaded, which means the attack still costs you server resources. Cloudflare filters at the edge, before the request reaches your host at all. Some plugin functionality, like file integrity monitoring, is still worth keeping.
