Cloud Maestro - WAF Security Suite for Cloudflare

1. Install Once - You only need to install the plugin to one site to manage all of your Cloudflare-connected domains 2. Connect Your Cloudflare Account – Securely enter your API credentials (encrypted and stored safely) 3. Select Your Domains – View all domains in your account with convenient checkboxes 4. Deploy Rules – Click once to apply proven security rules across all selected domains 5. Stay Protected – Your sites are now shielded from thousands of common threats and malicious or resource-hungry traffic

Yes, this plugin replaces the custom WAF rules in your Cloudflare configuration. Any existing custom rules will be overwritten. The plugin does not affect Cloudflare's managed rulesets or other settings—only custom WAF rules.

Yes. It uses API Tokens that are stored encrypted using AES-256-CBC (bank-level encryption) securely within WordPress. For additional security, it has a Settings Expiration timer that automatically deletes the API settings, or manually using the "Delete Settings" button when you're not actively managing rules.

No. The free version works independently and includes centralized WAF rule deployment for one Cloudflare account with multiple domains. The free version is ideal for managing up to 25 domains under one Cloudflare account. Premium expands this to multiple Cloudflare accounts and unlimited domains for agencies and professionals. Additionally, powerful customization options are available, including built-in bot whitelisting, custom user agents, custom IP addresses, and the IP Rules Manager.

This plugin is designed for Cloudflare Free, Pro, and Business plans. WAF features depend on Cloudflare’s plan limitations. Enterprise plans typically have different WAF rule management and may be controlled by your hosting provider, so this plugin may not be compatible.

No. The first rule explicitly allows verified bots from major search engines (Google, Bing), monitoring services, and other legitimate services. The Premium version offers even more control with 50+ built-in trusted services you can whitelist.

If you notice a service can't connect after applying rules, check Cloudflare's Events log to see what was blocked. You can then add that service's user agent or IP to the allowlist. Premium users can do this directly in the plugin with custom user agents and IP fields.

Yes! Developers can use WordPress filter hooks to customize or completely replace each rule expression. The plugin provides three filters: fivestar_cfwaf_good_bot_expression, fivestar_cfwaf_managed_challenge_expression, and fivestar_cfwaf_block_expression. Add your custom code to your theme's functions.php, a code snippet, or a custom plugin. For documentation and examples, visit our support site. You can also more easily add 50+ pre-configured service user agents across 8 categories via the Premium version, which offers simple checkbox selection, and custom text fields to add your own user agents or IPs as desired, and saves those settings for repeated use.

This plugin is independent and not affiliated, endorsed, or sponsored by Cloudflare®. Trademarks are used under fair use for compatibility and functionality only. No endorsement is implied. This plugin was inspired in part by Troy Glancy’s WAF Rules v3.