Secure your site behind Cloudflare

Cloudflare can block many attacks before they reach your website. It does not replace strong passwords, updates and backups. This guide lists the settings that give the most protection for the least work. Some features depend on your Cloudflare plan, so a few names may not appear on the Free plan.

Before you begin

• Your domain is Active in Cloudflare and the website works through it. See Cloudflare settings for APNCloud hosting.
• Access to the Cloudflare account and to your registrar.

Steps

1. Turn on two-factor authentication on your Cloudflare account. Open your profile and choose the authentication settings. Anyone who gets into this account can change your DNS.

2. Turn on DNSSEC. In Cloudflare open DNS, then Settings, and enable DNSSEC. Cloudflare shows a DS record. Add it at your registrar. If your registrar does not support DNSSEC, skip this step.

3. Check the WAF managed rules. Open Security, then WAF. Keep the managed rules that your plan includes turned on.

4. Turn on Bot Fight Mode. Open Security, then Bots. It can also challenge tools you use on purpose, such as uptime monitors and payment webhooks. If something stops working, open the Security events and look for the blocked request.

5. Limit login attempts. Create a rate limiting rule for the login pages of your site. Start with a low limit and adjust it later. The rate limiting rules you can use depend on your plan. Example expressions:

   (http.request.uri.path contains "/wp-login.php") or (http.request.uri.path contains "/xmlrpc.php")
   (starts_with(http.request.uri.path, "/admin"))

6. Protect forms with Turnstile. In Cloudflare open Turnstile and add a widget for your site. Put the site key in your form. Keep the secret key on the server only, never in the page.

7. Do not cache admin, login and cart pages. Open Caching, then Cache Rules, and create a rule with the action Bypass cache:

   (starts_with(http.request.uri.path, "/wp-admin")) or (http.request.uri.path contains "/wp-login.php") or (starts_with(http.request.uri.path, "/admin")) or (starts_with(http.request.uri.path, "/cart")) or (starts_with(http.request.uri.path, "/checkout"))

8. Keep the server address private. Records that must stay on DNS only, such as mail and FTP, show the IP address they point to. Cloudflare cannot hide that address. Remove old records you do not use, and never publish the server IP in your pages or emails.

9. Keep backups. Cloudflare does not back up your website. Use Website backups in the hosting panel and keep a copy outside the server before you make big changes.

Cloudflare protects web traffic only

Mail and FTP do not go through the Cloudflare proxy. Keep passwords unique, turn on two-step login where it is available, and update your website software. Read Secure your hosting.

Common mistakes

• Using "Cache Everything" without a bypass rule for admin and login pages.
• Rate limiting rules that are too strict, which lock out your own staff or customers.
• Turning on DNSSEC in Cloudflare but never adding the DS record at the registrar. Visitors may then fail to open the site.
• Putting the Turnstile secret key in the page source.
• Believing that Cloudflare replaces updates and backups.

Need help?

Open a support ticket in the Client Area or contact [SUPPORT_CONTACT] before you change a rule that you are not sure about.

Related articles

• Cloudflare settings for APNCloud hosting
• Secure your hosting
• Website backups
• WordPress behind Cloudflare

Last reviewed

2026-10-29