Cloudflare for WordPress Security

This article provides a practical Cloudflare baseline for WordPress websites.

Overview

WordPress sites are common targets for login attacks, plugin vulnerability scans, XML-RPC abuse, and unwanted bots. Cloudflare can reduce noise, but WordPress itself must still be updated and secured.

Recommended Steps

1. Keep WordPress core, themes, and plugins updated.
2. Use Full (strict) SSL/TLS and confirm WordPress site URLs use HTTPS.
3. Add a Managed Challenge or stricter rule for /wp-login.php.
4. Protect /wp-admin with Access, trusted IP restrictions, or challenge rules.
5. Consider restricting or rate limiting xmlrpc.php if the site does not need it.
6. Enable suitable Cloudflare Managed Rules for WordPress.
7. Test admin login, checkout, forms, cron, and API integrations after applying rules.

Common Mistakes to Avoid

• Blocking wp-admin in a way that also blocks admin-ajax.php for public features.
• Using a security plugin and Cloudflare rule that conflict with each other.
• Forgetting payment gateway callbacks or form submissions.
• Assuming Cloudflare replaces WordPress maintenance.

Share this: