The misconfiguration almost every Cloudflare site has
Cloudflare is a proxy, so once it is switched on every request arrives at WordPress from a Cloudflare address rather than the visitor's. Unless the original address is restored, everything inside WordPress that makes a decision about an IP is now reading the wrong one — your security plugin, your comment spam filter, your login rate limiter, your analytics. This is why people find their login log showing thousands of attempts from a single address, and why blocking that address locks out every visitor at once. It is a ten-minute fix and it is the first thing we check, because every other rule you write is built on top of it.
Bot Fight Mode is blunter than it sounds
The free Bot Fight Mode is a single switch with no scope, and it will happily challenge things you depend on: payment webhooks from Stripe, uptime monitors, your own automation calling the REST API, a booking system's callbacks. The failures it causes are intermittent and arrive with no obvious cause, which makes them expensive to trace. The right shape is almost always narrow rules aimed at the paths that actually get abused, with the automated traffic you rely on allowed through deliberately rather than by luck.
Turnstile instead of reCAPTCHA, on the forms that need it
reCAPTCHA v3 scores every visitor, which means it loads Google's script on every page of the site whether or not there is a form on it — a real cost to your loading times, and a third-party request on pages that had no reason to make one. Cloudflare's Turnstile does the same job without the puzzle, without the sitewide script, and without sending your visitors to Google to be scored. It is free, and on most sites it removes more spam than the plugin that was there before it.
Rules worth having on a WordPress site specifically
WordPress has a small number of paths that attract almost all the automated abuse: the login screen, XML-RPC, the REST route that lists usernames, and admin-ajax when a plugin exposes something expensive there. Rate limiting the login and challenging the rest removes the bulk of the noise without touching a single ordinary visitor, because ordinary visitors do not request any of them. Country blocking, which is what people usually reach for first, is a much worse trade — it is easy to evade and it silently loses you real customers who happen to be travelling.
Caching rules are where Cloudflare breaks shops
Aggressive caching at the edge is the main reason to have a CDN and the main way a WooCommerce site gets hurt by one. Cart, checkout, account pages and anything that varies by logged-in cookie must be excluded, or two customers can be served the same cached page — which is not a performance problem, it is a data problem. We set the bypass rules before turning caching up, not after somebody reports something strange.
Nothing here is allowed to cost you search traffic
It is entirely possible to configure Cloudflare so that Googlebot gets challenged, and the site does not tell you — rankings simply decay over the following weeks. Verified search crawlers are allowlisted explicitly, robots.txt is checked after the change rather than assumed, and we confirm the sitemap still fetches cleanly from outside the network. A security configuration that quietly costs you the traffic it was protecting is a bad trade whatever it blocked.
AI crawlers are a business decision, not a security one
Cloudflare will offer to block AI crawlers as a group, and that single switch conflates two different things: bots that take your content to train a model, and bots that read your site so an assistant can cite it and send someone to you. Blocking the first costs you nothing. Blocking the second removes you from ChatGPT, Claude and Perplexity answers entirely. We separate them, tell you plainly which is which, and let you decide — rather than flipping one switch and calling it protection.
What this costs
A full configuration pass — real IP restored, WAF and rate limiting rules written, Turnstile placed on your forms, caching rules made safe, verified bots allowlisted and the result tested from outside — starts at $300 and is fixed-quoted once we have looked at the site. If you would rather we simply diagnosed what is wrong with the current setup and wrote it down, that is $249. Ongoing changes are $165 an hour or cheaper in a block: $750 for five hours, $1,400 for ten.
