Cloudflare WAF set up without locking out customers or Google
Attacks and password guessing get stuck at Cloudflare before they reach your server. New rules start with a quick check only, and search engines and AI crawlers are on an allowlist.
Works with your website on
Signs your website needs a firewall
Most attacks are automated. They hit every website, however small.
Your server logs show requests for /wp-login.php or /.env, although those pages don't exist.
Someone tries hundreds of passwords on your admin login at night.
Your host throttled your plan because of “unusual load”.
A plugin update came late, and you don't know whether anyone used the hole.
Attacks no longer reach the server
From a client project. I don't name the client here, but I do show the result.
The server only works for customers now
At a mid-sized company, about one in three requests recently was an attack. The firewall catches them before they reach its server.
You see what was caught
Cloudflare's log lists every blocked request with rule, origin and target. After a week I go through it with you.
Values from Cloudflare, calendar weeks 32 to 44 of 2026
Attacks get stuck at Cloudflare, not on your server
The firewall checks every request before it reaches your website. I set up these four rules on every site.
Anyone who hits your login page too often in a short time is locked out for a while. Your team doesn't notice a thing.
- Your team logs inthrough
- Unknown address, 3rd trycounted
- Same address, 6th tryblocked
More that Cloudflare handles for your website
It all runs in the same Cloudflare account. Whatever you set up today can be extended later.
- ViewCloudflare ZarazTracking through your own domain, only after consent.
- ViewDDoS protectionYour website stays online during overload attacks.
- ViewCloudflare TurnstileReal inquiries instead of spam, without picture puzzles.
- ViewCloudflare and GDPREvery document your data protection officer asks for.
- ViewCloudflare WorkersSmall jobs run at Cloudflare, without a server.
What a firewall doesn't replace
Updating your software
A firewall stops many attacks on a hole but doesn't close it. CMS and plugin updates remain a must.
The big rulesets start at Pro
The free plan runs a basic ruleset. Cloudflare's full ruleset and the OWASP ruleset come with the Pro plan. I'll tell you beforehand whether it's worth it.
I'll tell you in a free intro call which plan is enough for your website.
How the setup works
No rule blocks anyone before I've seen who it would hit.
- 01Intro callIn 30 minutes we look at which attacks arrive today and which pages are most at risk.
- 02Rules on trialNew rules first show real visitors only a quick check instead of a block. That way I see whether they'd hit the wrong people.
- 03Switch on and reviewI switch the rules to blocking and go through the log with you after a week.
Fixed price after the intro call
For many company websites, Cloudflare's free plan is enough. You get scope, plan and price in writing.
Questions about the Cloudflare WAF
Christian Schmitt answersA WAF checks every request to your website before it reaches your server. If it detects an attack, such as malicious code in a form field or mass password guessing, it blocks the request. Normal visitors don't notice anything.
Christian Schmitt answersPart of it. The free plan includes a basic ruleset, five custom firewall rules, one rate limiting rule and bot protection. Cloudflare's full ruleset and the OWASP ruleset come with the Pro plan.
Christian Schmitt answersRate limiting caps how often one address may request a page in a short time. That slows down password guessing on your login page, for example, or bots submitting your contact form hundreds of times.
Christian Schmitt answersA plugin runs on your server. Every attack has to get there first and uses processing time. The Cloudflare WAF stops it earlier. Both together do no harm, but the WAF takes load off your server.
Christian Schmitt answersYes, if the rules are too strict. That's why my new rules first show only a quick check, and search engines and AI crawlers are on an allow list.
Christian Schmitt answersYes. Cloudflare sits in front of your website, whether that's WordPress, Webflow or your own server. For WordPress I also add rules for typical targets such as /wp-login.php and xmlrpc.php.
