WAF Manager for Cloudflare

This is the WordPress.org edition, and it contains the WAF Rules Builder only. The full version, WP WAF Manager, adds DNS management, zone analytics, zone controls and cache purge, IP access rules, security events, email routing, and multi-account support. It is available free on GitHub, or from wpwafmanager.com for automatic updates and priority support. The full version is fully compatible with this edition and runs on the same site. WAF Manager for Cloudflare lets you deploy a set of battle-tested Cloudflare WAF (Web Application Firewall) rules to any of your Cloudflare zones in one click, right from your WordPress admin — no Cloudflare dashboard or Rules expression language required. WAF Rules Builder Deploy five pre-configured, battle-tested security rules to any Cloudflare zone in one click, based on the open-source wafrules.com ruleset:

• Allow Good Bots — Whitelist Cloudflare verified bot categories (Googlebot, Bingbot, uptime monitors, payment processors) plus a custom IP allowlist, a custom user agent allowlist, and your own custom Cloudflare expressions
• Block Aggressive Crawlers — Block SEO scrapers, exploit scanners (SQLMap, Nikto, Masscan, Nmap), and sensitive WordPress paths (xmlrpc.php, wp-config.php, install.php)
• Block Web Hosts & TOR — Block traffic from cloud hosting ASNs (DigitalOcean, Vultr, Hetzner, OVH, Contabo, and more) and TOR exit nodes
• Challenge Large Cloud Providers — Managed challenge for AWS EC2, Google Cloud, and Azure traffic
• Challenge VPN & wp-login — Managed challenge for NordVPN, ExpressVPN, Surfshark, and other VPN providers plus the WordPress login page

Each rule is fully customizable with checkboxes — no need to write a single line of Cloudflare expression syntax. Additional builder features:

• Live expression preview as you toggle options
• Custom Allow Expressions — add your own Cloudflare rules language expressions to Rule 1 to always skip the WAF, for cases the built-in allowlists don't cover (specific webhook paths, Cloudflare managed IP lists, request headers, and so on)
• Deploy to any single Cloudflare zone, or select multiple zones to deploy to at once
• Automatic Cloudflare Free plan compatibility (restricted phases are stripped and retried automatically)

Plugin Settings

• Access control — minimum role picker (Administrator recommended)
• User access allowlist — restrict the plugin to specific administrator accounts
• Keep data on uninstall toggle (on by default)
• Test Connection — verify your Cloudflare API credentials instantly

Requirements

• WordPress 6.0 or later
• PHP 8.0 or later
• A Cloudflare account with at least one active zone
• An API Token with: Zone → WAF → Edit and Zone → Zone → Read

External services This plugin connects to the Cloudflare API to read your zones and to create, read, and deploy WAF rules on your behalf. This service is required for the plugin to function — without a Cloudflare account and API credentials, the plugin has nothing to manage. Requests are sent to the Cloudflare API at https://api.cloudflare.com only from your WordPress admin, and only when you take an action that requires it: verifying credentials, testing the connection, listing your zones, listing existing rules, previewing rules, or deploying rules. The data sent consists of the Cloudflare credentials you enter (an API Token, or an account email plus Global API Key), the zone IDs you select, and the WAF rule definitions you build in the plugin. No data about your site's visitors and no personal data about your WordPress users is sent. The plugin does not send data to any other third-party service. Cloudflare is a third-party service operated by Cloudflare, Inc. By using this plugin to connect to Cloudflare, you are subject to their terms and policies:

• Terms of Service: https://www.cloudflare.com/terms/
• Privacy Policy: https://www.cloudflare.com/privacypolicy/

Trademarks This plugin is independent and is not affiliated with, endorsed by, or sponsored by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc., referenced here only to describe what this plugin is compatible with. No endorsement or affiliation is implied.

1. Upload the waf-manager-for-cloudflare folder to /wp-content/plugins/ or install via Plugins → Add New → Upload Plugin
2. Activate via Plugins → Installed Plugins
3. Navigate to WAF Manager in the admin sidebar
4. Enter your Cloudflare API Token and click Verify & Save

Creating Your API Token

1. Visit Cloudflare API Tokens
2. Click Create Token and start from a Custom Token
3. Add permissions: Zone → WAF → Edit and Zone → Zone → Read
4. Set Zone Resources to "All zones" (or specify the zones you want)
5. Copy the token into the plugin and click Verify & Save

1.0.22

• Added: Custom Allow Expressions in Rule 1. A new repeater field in the Allow Good Bots section lets you add individual Cloudflare expressions that will always skip all WAF rules. Each expression gets its own input row. Use cases include allowing specific webhook paths (starts_with(http.request.uri.path, "/surecart/webhooks")), Cloudflare service IP lists (ip.src in $services_ip_list), or any other expression the Cloudflare rules language supports. Each entry is OR'd onto Rule 1 alongside the existing bot category and user agent allowlists. Parentheses are added automatically. Expressions must be valid Cloudflare syntax — invalid expressions will cause the deploy to fail for that zone.

1.0.21

• Initial WordPress.org release.
• Focused build: the WAF Rules Builder, deploying five battle-tested Cloudflare WAF rules to any zone in one click.
• Live Cloudflare expression preview before deploying.
• Automatic Cloudflare Free plan compatibility — restricted rule phases are stripped and retried.
• Access control: minimum role picker and per-user allowlist.
• Keep-data-on-uninstall toggle (enabled by default). Full changelog at https://www.wpwafmanager.com/changelog/