We’re massive fans of Cloudflare and deploy it as part of our speed optimization services.

Cloudflare has an amazing range of features and options and a lot of the features go unused or under leveraged. In this post we’ll share three Cloudflare that will both help improve the security or your WordPress site and at the same time also reduce the load on your site and help speed it up.

These are really easy to setup and if you’re moderately tech savvy will take you maybe 10-15 minutes. Click the images to enlarge.

Table of Contents

How to add Cloudflare Firewall rules

Firewall rules can be added under the Firewall menu->Firewall Rules tab in Cloudflare. The free plan gives you up to 5 rules so these can be added at no cost.

Once you add a rule it takes effect almost immediately.

How To Add Cloudflare Firewall Rules — Add Rules Under Firewall-≫Firewall Rules (Click To Enlarge)

1. Block access to XMLRPC.php

This is an older WordPress API interface that is very rarely used but is a vector for many attacks.

Hammering this file with requests can very quickly chew up a lot of CPU cycles and on a shared host or host with low CPU or resources available it may start throwing 502 and 504 errors.

Block Xmlrpc Using Cloudflare — Blocking The Xmlrpc Interface In Cloudflare Can Significantly Reduce Cpu Load Particularly On Slower Hosts Or Shared Hosting (Click To Enlarge)

2. Block SEO Bots & Crawlers

With this rule we block traffic from Ahrefs, Semrush and Opensite explorer (SEO Moz bot) SEO bots.

These are extremely aggressive crawlers and particularly on Woocommerce they’ll rapidly add and remove things from the cart multiple times per second again chewing a lot of CPU resources.

In addition, allowing them to crawl the site will also divulge some SEO information that competitors using these SEO tools may find useful.

Block Seo Bots And Crawlers Using Cloudflare — Seo Crawlers Can Be Super Aggressive And Also Divulge Information About Your Site You Probably Don’T Want To Share With Competitors. This Blocks The Three Most Aggressive Bots We See. (Click To Enlarge)

3. Show a captcha message on the WordPress logon page

The typical WordPress site we see can get anywhere from 1000-10000 brute force logon attempts a day.

Adding a rule to show a captcha message to visitors hitting this page OR visitors hitting this page outside the home country of the site can dramatically reduce brute force password attempts and reduce a lot of load on the hosting.