WordPress: Use Azure Front Door to rate limit access the login page

waf-policy.bicep

resource wafPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2022-05-01' = {
  name: wafPolicyName
  location: 'global'
  sku: {
    name: frontDoorSkuName
  }
  tags: tags
  properties: {
    policySettings: {
      enabledState: 'Enabled'
      mode: wafMode
      customBlockResponseStatusCode: 429
    }
    customRules: {
      rules: [
        {
          name: 'RateLimitOthers'
          priority: 1
          ruleType: 'RateLimitRule'
          matchConditions: [
            {
              matchVariable: 'RemoteAddr'
              operator: 'GeoMatch'
              negateCondition: true // Don't match the matchValue
              matchValue: [
                'NO' // ISO country code for Norway
              ]
            }
            {
              matchVariable: 'RequestUri'
              operator: 'BeginsWith'
              matchValue: [
                '/wp-login.php'
              ]
            }
          ]
          action: 'Block'
          rateLimitThreshold: 5 // Set your rate limit threshold
          rateLimitDurationInMinutes: 1 // Set your rate limit duration
        }
      ]
    }
  }
}