Custom Cloudflare WAF Rule - WordPress .php request hardening. To use, log into Cloudflare -> Click on your domain -> Security -> WAF -> Custom Rules -> Create Rule -> Edit Expression -> Paste the code -> Deploy

cloudflare-wordpress-php-hardening

(http.request.uri.path contains "php" and not http.request.uri.path contains "wp-login" and not http.request.uri.path contains "wp-cron" and not http.request.uri.path contains "wp-admin/" and not http.request.uri.path contains "wp-admin/a" and not http.request.uri.path contains "wp-admin/c" and not http.request.uri.path contains "wp-admin/e" and not http.request.uri.path contains "wp-admin/f" and not http.request.uri.path contains "wp-admin/i" and not http.request.uri.path contains "wp-admin/l" and not http.request.uri.path contains "wp-admin/m" and not http.request.uri.path contains "wp-admin/n" and not http.request.uri.path contains "wp-admin/o" and not http.request.uri.path contains "wp-admin/p" and not http.request.uri.path contains "wp-admin/r" and not http.request.uri.path contains "wp-admin/s" and not http.request.uri.path contains "wp-admin/t" and not http.request.uri.path contains "wp-admin/u" and not http.request.uri.path contains "wp-admin/w" and not http.request.uri.path contains "/php/")