This is the WordPress.org edition, and it contains the WAF Rules Builder only.

The full version, WP WAF Manager, adds DNS management, zone analytics, zone controls and cache purge, IP access rules, security events, email routing, and multi-account support. It is available free on GitHub, or from wpwafmanager.com for automatic updates and priority support. The full version is fully compatible with this edition and runs on the same site.

WAF Manager for Cloudflare lets you deploy a set of battle-tested Cloudflare WAF (Web Application Firewall) rules to any of your Cloudflare zones in one click, right from your WordPress admin — no Cloudflare dashboard or Rules expression language required.

WAF Rules Builder

Deploy five pre-configured, battle-tested security rules to any Cloudflare zone in one click, based on the open-source wafrules.com ruleset:

Allow Good Bots — Whitelist Cloudflare verified bot categories (Googlebot, Bingbot, uptime monitors, payment processors) plus a custom IP allowlist, a custom user agent allowlist, and your own custom Cloudflare expressions
Block Aggressive Crawlers — Block SEO scrapers, exploit scanners (SQLMap, Nikto, Masscan, Nmap), and sensitive WordPress paths (xmlrpc.php, wp-config.php, install.php)
Block Web Hosts & TOR — Block traffic from cloud hosting ASNs (DigitalOcean, Vultr, Hetzner, OVH, Contabo, and more) and TOR exit nodes
Challenge Large Cloud Providers — Managed challenge for AWS EC2, Google Cloud, and Azure traffic
Challenge VPN & wp-login — Managed challenge for NordVPN, ExpressVPN, Surfshark, and other VPN providers plus the WordPress login page

Each rule is fully customizable with checkboxes — no need to write a single line of Cloudflare expression syntax. Additional builder features:

Live expression preview as you toggle options
Custom Allow Expressions — add your own Cloudflare rules language expressions to Rule 1 to always skip the WAF, for cases the built-in allowlists don’t cover (specific webhook paths, Cloudflare managed IP lists, request headers, and so on)
Deploy to any single Cloudflare zone, or select multiple zones to deploy to at once
Automatic Cloudflare Free plan compatibility (restricted phases are stripped and retried automatically)

Plugin Settings

Access control — minimum role picker (Administrator recommended)
User access allowlist — restrict the plugin to specific administrator accounts
Keep data on uninstall toggle (on by default)
Test Connection — verify your Cloudflare API credentials instantly

Requirements

WordPress 6.0 or later
PHP 8.0 or later
A Cloudflare account with at least one active zone
An API Token with: Zone WAF Edit and Zone Zone Read

External services

This plugin connects to the Cloudflare API to read your zones and to create, read, and deploy WAF rules on your behalf. This service is required for the plugin to function — without a Cloudflare account and API credentials, the plugin has nothing to manage.

Requests are sent to the Cloudflare API at https://api.cloudflare.com only from your WordPress admin, and only when you take an action that requires it: verifying credentials, testing the connection, listing your zones, listing existing rules, previewing rules, or deploying rules.

The data sent consists of the Cloudflare credentials you enter (an API Token, or an account email plus Global API Key), the zone IDs you select, and the WAF rule definitions you build in the plugin. No data about your site’s visitors and no personal data about your WordPress users is sent. The plugin does not send data to any other third-party service.

Cloudflare is a third-party service operated by Cloudflare, Inc. By using this plugin to connect to Cloudflare, you are subject to their terms and policies:

Trademarks

This plugin is independent and is not affiliated with, endorsed by, or sponsored by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc., referenced here only to describe what this plugin is compatible with. No endorsement or affiliation is implied.