WAF Manager for Cloudflare
| 开发者 |
ja1me4
nahnuplugins |
|---|---|
| 更新时间 | 2026年10月29日 04:21 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
This is the WordPress.org edition, and it contains the WAF Rules Builder only.
The full version, WP WAF Manager, adds DNS management, zone analytics, zone controls and cache purge, bot control, SSL monitoring, Cloudflare alerts and health checks, Turnstile widget management, Page Rules migration, IP access rules, security events, email routing, white-label client reports, and multi-account support. It is available free on GitHub, or from wpwafmanager.com for automatic updates and priority support. The full version is fully compatible with this edition and runs on the same site.
WAF Manager for Cloudflare deploys a proven set of Cloudflare WAF (Web Application Firewall) custom rules to your Cloudflare zones from your WordPress admin. You choose what each rule allows, blocks or challenges with checkboxes, and the plugin writes the Cloudflare expressions and deploys them in the correct order.
The five rules
Based on the open-source wafrules.com ruleset, updated to the October 24, 2026 release:
- Allow Good Bots (Skip). Allows every Cloudflare verified bot, or only the categories you pick, plus services matched by the IP lists they publish (ManageWP, WP Umbrella, ShortPixel, Patchstack and more), Let's Encrypt, your own server IPs, an IP allowlist, custom user agents and custom Cloudflare expressions. It runs first so nothing below blocks legitimate traffic, while Cloudflare's managed rules still protect it.
- Block Aggressive Crawlers & WordPress Paths (Block). Blocks aggressive crawlers and exploit scanners (SQLMap, Nikto, Masscan, Nmap), generic bot patterns, curl scripts (with an exception list for your API and webhook hostnames), and sensitive WordPress paths (xmlrpc.php, wp-config, install.php, readme.html, license.txt) in any letter case.
- Block or Challenge Web Hosts / TOR & Exploit URIs. Blocks or challenges traffic from hosting and VPS networks (DigitalOcean, Linode, Vultr, Hetzner, OVH, Contabo and more), three networks known for WordPress attack traffic and TOR exit nodes, and blocks six groups of exploit URIs: time-delay and UNION SQL injection, file inclusion, legacy exploits, other CMS probes and XSS.
- Challenge Large Providers / Country (Managed Challenge). Challenges traffic from AWS, Google Cloud and Azure, and optionally visitors from outside the countries you select.
- Challenge VPN Connections & wp-login (Managed Challenge). Challenges known VPN providers and protects the WordPress login page.
- Live expressions: the Expressions tab shows the exact Cloudflare expression each rule will deploy, with its length against Cloudflare's 4,096-character limit. A deploy stops with a clear message before sending a rule that is too long.
- Custom Allow Expressions: add your own Cloudflare rules language expressions to Rule 1 for cases the built-in allowlists don't cover, such as webhook paths or Cloudflare managed IP lists.
- Deploy to one zone or many: pick any zones in your Cloudflare account and deploy to all of them at once.
- Keeps your own rules: deploying replaces only this plugin's rules and keeps any other custom rules on the zone after them. A "Replace all custom rules" option clears the zone when you want a clean start.
- Zone Rules tab: see the custom rules currently live on any zone.
- Free plan compatible: when Cloudflare restricts a rule phase on your plan, the plugin removes it and retries so the deploy still succeeds.
- Export, import and reset: save your configuration as a JSON file, load it on another site, or reset everything to the defaults.
- Minimum role that can use the plugin (Administrator recommended)
- Allowlist of specific administrators who can access the plugin
- Keep or delete plugin data on uninstall (kept by default)
- Test Connection to check your Cloudflare credentials
- WordPress 6.0 or later
- PHP 8.0 or later
- A Cloudflare account with at least one active zone
- An API Token with Zone > WAF > Edit and Zone > Zone > Read, or your account email and Global API Key
https://api.cloudflare.com only from your WordPress admin, and only when you take an action that requires it: verifying credentials, testing the connection, listing your zones, listing existing rules, or deploying rules.
The data sent consists of the Cloudflare credentials you enter (an API Token, or an account email plus Global API Key), the zone IDs you select, and the WAF rule definitions you build in the plugin. No data about your site's visitors and no personal data about your WordPress users is sent. The plugin does not send data to any other third-party service.
Cloudflare is a third-party service operated by Cloudflare, Inc. By using this plugin to connect to Cloudflare, you are subject to their terms and policies:
- Terms of Service: https://www.cloudflare.com/terms/
- Privacy Policy: https://www.cloudflare.com/privacypolicy/
安装:
- In WordPress, go to Plugins > Add New, search for "WAF Manager for Cloudflare", then install and activate it.
- Open WAF Manager in the admin sidebar.
- Enter your Cloudflare API Token and click Verify & Save.
- Review the five rules, click Save Settings, then Deploy Rules to Your Sites and choose your zones.
- Visit Cloudflare API Tokens.
- Click Create Token and start from a Custom Token.
- Add permissions: Zone > WAF > Edit and Zone > Zone > Read.
- Set Zone Resources to "All zones", or to the zones you want to manage.
- Copy the token into the plugin and click Verify & Save.
屏幕截图:
常见问题:
Will deploying replace rules I already created in Cloudflare?
No. Deploying replaces only this plugin's own rules (named "[CF WAF] ...") and keeps your other custom rules on the zone, placed after the plugin's rules so Rule 1 still runs first. If you want a clean zone, tick "Replace all custom rules in the zone" before deploying; you will be asked to confirm. Managed rules, rate limiting rules and other Cloudflare settings are not changed either way.
My Free zone says it has no room for more rules.
The Cloudflare Free plan allows five custom rules in total, and this plugin uses five. If the zone already has rules of its own, either remove them in Cloudflare or deploy with "Replace all custom rules in the zone".
Does this work on Cloudflare Free plans?
Yes. When Cloudflare restricts a rule phase on your plan, the plugin removes it and retries so the deploy still succeeds.
Do I need to know the Cloudflare expression language?
No. Every rule is built from checkboxes, and the plugin writes the expressions for you. You can review them on the Expressions tab before deploying.
A service I use is being blocked. What do I do?
In Cloudflare, check Security > Analytics > Events to see which rule blocked it. Then allow it in Rule 1: turn on its bot category or service, or add its IP addresses (preferred, since user agents are easy to fake), user agent or a Custom Allow Expression, and deploy again.
Is my API token stored securely?
Credentials are encrypted at rest using libsodium (sodium_crypto_secretbox), with a key derived from your site's AUTH_KEY salt, so the key is unique to your site and is never stored in the database. Credentials are saved with autoload disabled and are never sent back to the browser. Use a scoped API Token with only the permissions listed above rather than your Global API Key.
I updated and some user agents moved. Why?
The October 2026 ruleset no longer allows services by user agent, because a user agent is easy to fake. Services Cloudflare verifies are covered by "Allow every Cloudflare verified bot", and services that publish their IP addresses have their own switch. Services that do neither, such as UpdraftPlus and BackupBuddy, were moved into Custom User Agents to Allow so nothing stops working, and a notice on the WAF Rules screen lists them.
Can I keep my credentials out of the database?
Yes. Define them in wp-config.php and the plugin uses them read-only:
define( 'WPWAF_API_TOKEN', 'your-cloudflare-api-token' );
Or, with a Global API Key:
define( 'WPWAF_API_EMAIL', 'you@example.com' );
define( 'WPWAF_API_KEY', 'your-global-api-key' );
What happens when I delete the plugin?
By default all plugin data is kept, which is safe for testing or temporary removal. To remove everything on delete, turn off "Keep data on uninstall" in Settings before deleting the plugin.
更新日志:
1.0.26
- Changed: every emoji on the WAF Rules, Settings and About screens is now an SVG icon that follows the text color, so the screens look the same on Windows, Mac and every browser instead of showing letters or empty boxes.
- Added: every country in the Rule 4 country picker shows its flag. Flags are images bundled with the plugin.
- Added: each Quick Pick button in the Rule 4 country picker (North America, Europe, Asia, Oceania, Latin America, MENA, GCC and Africa) shows a small map of its region. MENA and GCC had no icon before.
- Changed: removed the em dashes from on-screen text, such as the Challenge All VPN Connections option.
- Changed: the WAF rules follow the October 24, 2026 wafrules.com release. Saved settings are updated automatically; deploy again to apply the new rules.
- Added: Rule 2 blocks curl user agents, with an "Except these hostnames" list for API and webhook hosts. Turn it off on app or API sites that people call with curl.
- Added: Rule 3 always blocks three hosting networks known for WordPress exploit and secrets-scanning traffic (AS48090 TECHOFF SRV / DMZHOST, AS211590 Bucklog / FBW Networks, AS218785 TC Datacenter), even when Block Web Host ASNs is off. Each one can be unticked.
- Changed: WP Umbrella is allowed by its latest published IP lists, and the interim option for unlisted DigitalOcean monitors is removed.
- Changed: blocking wp-config.php and install.php is now on by default for new setups.
- Changed: all five WAF rules follow the October 21, 2026 wafrules.com release, with the new rule names. Saved settings and imported files are moved to the new layout automatically.
- Changed: Rule 1 can allow every Cloudflare verified bot with one switch, or only the categories you pick. A list under the switch shows which services each choice covers.
- Changed: Better Stack, EWWW and Easy IO, GoSweetSpot, Imagify, ManageWP, Patchstack, SEMrush Site Audit, ShortPixel and WP Umbrella are allowed by the IP addresses each service publishes instead of by user agent, which is easy to fake.
- Changed: Rule 1 no longer skips Cloudflare managed rules, so allowed traffic still gets Cloudflare's emergency CVE protection.
- Changed: Rule 2 matches WordPress paths in any letter case. The SQL injection and path traversal patterns moved to Rule 3, which now blocks six groups of exploit URIs.
- Changed: user agents for services that are not verified bots and publish no IP list (such as UpdraftPlus and BackupBuddy) are moved into Custom User Agents to Allow, and a notice lists them.
- Added: deploying keeps your other custom rules on the zone, after the plugin's rules. A "Replace all custom rules in the zone" option clears them when wanted.
- Added: each rule shows its length against Cloudflare's 4,096-character limit, and a deploy stops before sending a rule that is too long.
- Added: Let's Encrypt, Apple Messages and FlyingPress allowances and a Your server IPs box in Rule 1.
- Added: North Korea, Palestine and South Korea in the Rule 4 country list.
- Fixed: importing settings now runs through the server, converts older exports, and updates the screen straight away.
- Fixed: ticking every administrator under User Access now saves as "no restriction", so administrators added later also get access.
- Fixed: a release packaging error. The 1.0.23 download from WordPress.org contained files from a different plugin, which caused a fatal error ("Class WMFC_Admin not found") on activation or update. This release restores the correct files.
- Improved: if the plugin's files are ever incomplete, it now pauses itself and shows an admin notice instead of stopping the whole site.
- Improved: the deploy screen now states that deploying replaces the existing custom WAF rules on the selected zones.
- Updated the readme.
- Fixed: the plugin now loads on PHP 8.0, the stated minimum. One class used a PHP 8.1 feature.
- Security: Cloudflare API tokens and keys are no longer sent back to the browser after saving or removing credentials. The browser only receives the account label and status.
- Security: zone and rule IDs are validated before they are used in a Cloudflare API request, and request paths that could point to a different endpoint are refused.
- Fixed: the WAF Rules header no longer extends past the right edge of the page, which caused a horizontal scrollbar on laptop screens.
- Fixed: mobile styles now apply on every screen. Each page's own styles were overriding them.
- Fixed: bot category labels with "CF:" tags no longer overflow the screen on phones.
- Fixed: the Academic Research bot category now displays "Bibliothèque" correctly.
- Improved: consistent page width and gutters on all screens, with a wider WAF Rules layout on large monitors and a narrower reading width for Settings and About.
- Improved: the WAF Rules tabs fade at the right edge on small screens to show more tabs can be scrolled into view.
- Improved: clearer wording in labels and messages.
- Confirmed compatibility with WordPress 7.1.
- Added: Custom Allow Expressions in Rule 1. Add individual Cloudflare expressions that always skip all WAF rules, one per row, for example a webhook path (starts_with(http.request.uri.path, "/surecart/webhooks")) or a Cloudflare managed IP list (ip.src in $services_ip_list). Each entry is added to Rule 1 as an OR condition, and parentheses are added automatically. Expressions must be valid Cloudflare syntax, or the deploy fails for that zone.
- Initial WordPress.org release.