Cloudflare Firewall Rules For WordPress Site Speed & Security

0:00Three Cloudflare Firewall Rules That Filter Junk Traffic

Okay, let me share with you three Cloudflare firewall rules that will filter a lot of the crap hitting your WordPress site and also help speed it up somewhat, because it will reduce the load on the hosting. So, let me talk through these three here. I'll do them out of order. The first one is to block XML-RPC. I'll click into each of these as we go through them. XML-RPC.php.

0:23Blocking XML-RPC.php

This is an old API interface file. It's called the remote publishing interface, or remote publishing connector, something like that. That's what RPC comes from. Anyway, it's a vector for attacks. Quite commonly, attackers and kind of dodgy traffic will hit the XML-RPC file in an attempt to get into the site or exploit vulnerabilities. The traffic hitting this can be quite brutal. You can flood the XML-RPC file with a lot of traffic and it will knock over the hosting, essentially. It'll chew up a lot of CPU cycles.

Out of the thousands of sites we've worked on, I don't think we've had even one that uses the XML-RPC interface. A lot of security plugins and things will disable this, but a simple way to do it in Cloudflare is just to block it with this rule here. Any of these URL path strings will work, but here it's URL contains XML-RPC.php, and then the action is block. It's pretty straightforward.

You can see here that it's blocked five attempts to get in over the last 24 hours. There's no reason why these IP addresses should be hitting that, but you can see it's blocked five of them. That's actually quite low. Typically we'd see more than that. Also, what we find with these rules is that once we put them in place, after they've been in place for a week or two, the site stops getting a lot of that garbage traffic. It just goes away. I don't know if there are lists that are shared around of websites with exploits or whatever, but once these rules are in place, you'll see the noise die down after they've been in there for a couple of weeks.

1:56Blocking SEO Crawlers

Okay, the next one, block SEO crawlers. There are three SEO crawlers that we block, and we've got four here. Three typically: SEMrush, Ahrefs, and Open Site Explorer, which is Moz. This fourth one was hammering the site, so we added it in here as well, but normally we wouldn't do that. These three are common SEO tools, and one big issue, particularly on WooCommerce sites, is that they're very aggressive with adding and removing things to the cart.

So, they follow the cart and wish list links, so they'll add and remove things to the cart and wish list in WooCommerce very rapidly, several times per second. Again, particularly on lower-end hosting or shared hosting, that absolutely chews up CPU cycles. That's like a user sitting there with multiple people checking out at once or working on the cart at once. So, a simple way to fix this problem is to block them as well. The other benefit is that these tools actually divulge information about the SEO on the website and the structure of the website. By blocking them, you block some of the data that they give away to potential competitors as well.

This is pretty simple, a similar sort of thing: user agent contains SEMrush. You see here, it's not the full user agent string. It's not the full user agent string, it just has that in the string. We just use OR rules: user agent contains SEMrush, or user agent contains Ahrefs, or Open Site Explorer, and then we just block them. Again, you can see they're actually super aggressive. There were 32 hits in the last 24 hours. Again, they kind of go away once they've been blocked a bit, but that's still a fair amount of traffic, and there's no benefit to having that traffic on the website if you're not using those tools.

Now, just a note that this will block the SEO audit function of those tools. If you are paying for those tools, or the client is paying for those tools, the SEO auditing on the client's own website won't work anymore. Just keep that in mind.

4:13Login Page Protection With a CAPTCHA Challenge

The last one is having a CAPTCHA message on the WP login page. Again, this gets hammered by brute force password attempts. You can block it with Wordfence and other security tools, but blocking it at Cloudflare means it's blocked before it hits the website, before it even starts chewing CPU cycles. So this is also very useful. In a WooCommerce environment, it might challenge real users, which might be a problem when they're logging into the My Account page. So maybe use that liberally if you have a WooCommerce site you're working on.

But, it's pretty simple here, a similar sort of thing: URL contains wp-login.php. This one is for our site, so there aren't really any brute force attempts coming from Australia. There might be a handful, but not particularly. So if the country is not Australia, then show a CAPTCHA message for that page. What that does is show just the default Cloudflare CAPTCHA before someone is allowed to access the login page for WordPress. That again filters so much crap, and because you start blocking the crap, it tends to go away.

In the last 24 hours, this is actually really low. When we first put this on a site, we can sometimes see somewhere between 1,000 and 10,000 per day. If you think about that, 10,000 attempts a day hammering the login is going to chew up so many CPU cycles and work PHP really hard. Here we only had 12 attempts. If we click into that, you see people from all over the place: Vietnam, Netherlands, France, US and Turkey. It just keeps going, but none of those are genuine. If we go back here, CSR means the CAPTCHA was solved, I think, the CAPTCHA solve rate. So 0% of those people were real users. It's not that many now, but it was definitely in the hundreds and thousands when we initially did it.

6:06Free Plan Limits and How to Check the Rules Work

Really simple. You can do this on the free Cloudflare plan. I think this is the paid Cloudflare plan, because we have 20 rules here, but I think on the free plan you can add five. There's more than enough scope to add these on the free plan, and it makes a huge difference, especially on WooCommerce sites. It'll chop down the CPU usage substantially. So yeah, it's really simple.

The most powerful one on WooCommerce is probably the SEO crawler one, but on general sites, the login is probably the one that's getting hammered the most. Pretty straightforward. They take effect straight away, so yeah. If you want to see if they're working, add the rule and then come back a day later and check. You should see some numbers in there. That's it. Very straightforward.