Cloudflare Custom Rules for WordPress

gistfile1.txt

These are settings that I like to use for WordPress sites to mitigate common malicious traffic. These generally get around the Cloudflare WAF so are good supplemental rules to add.  
  
These can be created by going to Security -> WAF, click the 'Custom Rules' tab and then click 'Create Rule'

___

# Title
Challenge all PHP page requests that aren't wp-admin or wp-login

## Conditions
• URI Full ends with php AND
• URI Full does not contain wp-admin AND
• URI Full does not contain wp-login

## Then take action...
Managed Challenge

___

# Title
Block xmlrpc.php requests

## Conditions
• URI Full ends with xmlrpc.php

## Then take action...
Block

___

# Title
Challenge all non-US traffic

## Conditions
Country does not equal United States

## Then take action...
Managed Challenge