https://github.com/kamrullab/cloudflare-security-rules
This repository provides a complete Cloudflare WAF setup guide, including custom rules for bot protection, country blocking, and CAPTCHA verification. Learn how to configure firewall settings step by step to secure your website against threats.
https://github.com/kamrullab/cloudflare-security-rules
bot-protection captcha cloudflare cloudflare-rules cloudflare-security cloudflare-waf cloudflare-waf-rules custom-rules custom-rulesets cybersecurity ddos-protection firewall ip-blocking security security-rules waf waf-configuration web-application-firewall website-protection
Last synced: 3 months ago
JSON representation
This repository provides a complete Cloudflare WAF setup guide, including custom rules for bot protection, country blocking, and CAPTCHA verification. Learn how to configure firewall settings step by step to secure your website against threats.
- Host: GitHub
- URL: https://github.com/kamrullab/cloudflare-security-rules
- Owner: kamrullab
- License: mit
- Created: 2025-03-02T08:50:39.000Z (4 months ago)
- Default Branch: main
- Last Pushed: 2025-03-02T09:03:51.000Z (4 months ago)
- Last Synced: 2025-03-02T10:19:23.363Z (3 months ago)
- Topics: bot-protection, captcha, cloudflare, cloudflare-rules, cloudflare-security, cloudflare-waf, cloudflare-waf-rules, custom-rules, custom-rulesets, cybersecurity, ddos-protection, firewall, ip-blocking, security, security-rules, waf, waf-configuration, web-application-firewall, website-protection
- Homepage:
- Size: 4.88 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# 🔥 Cloudflare Web Application Firewall (WAF) and Security Setup
## 🌍 Overview
This repository provides a complete **step-by-step guide** to setting up and configuring **Cloudflare Web Application Firewall (WAF)**. It helps protect websites against **malicious attacks, bot traffic, and unauthorized access**. This guide includes the process of **creating custom rules**, **understanding firewall settings**, and **applying CAPTCHA verification** to enhance security and performance.
---
# 📌 **How to Create Cloudflare WAF Rules (Step-by-Step Guide)**
## 🚀 **Step 1: Accessing Cloudflare Security Settings**
1. **🔑 Login to Cloudflare**: Go to [Cloudflare Dashboard](https://dash.cloudflare.com/) and log in.
2. **🌐 Select Your Website**: Click on the website you want to protect.
3. **🛡️ Navigate to WAF**: In the left sidebar, go to **Security > WAF (Web Application Firewall)**.
4. **⚙️ Go to Custom Rules**: Click on the **Custom Rules** tab.
## 🏗️ **Step 2: Creating a New Custom Rule**
1. Click on **➕ Create Rule**.
2. Enter a **📝 Rule Name** (e.g., `CAPTCHA SKIP` for bots).
3. Choose a **📌 Field** (e.g., `User Agent` to detect bots).
4. Select an **⚙️ Operator** (e.g., `contains` to match specific bots).
5. Enter a **📥 Value** (e.g., `Googlebot` for Google Search bot).
6. Choose an **🔒 Action** (e.g., `Skip` for trusted bots, `Block` for countries, or `Managed Challenge` for CAPTCHA).
7. Set the **🔄 Placement Order** (first, after another rule, etc.).
8. Click **💾 Save** and ensure the rule is **✅ Enabled**.
---
# 🎯 **Custom Rules Configuration (Basic to Advanced)**
Below are **three essential WAF rules**, explained in three formats: **Table Format, Copyable Code Format, and Detailed Explanation**.
---
## **1️⃣ CAPTCHA SKIP Rule (Allowing Search Engine Bots) 🤖**
### ✅ **📋 Table Format**
| **📌 Field** | **⚙️ Operator** | **📥 Value** |
|--------------|------------|----------------------|
| User Agent | contains | facebookexternalhit |
| OR | contains | TwitterBot |
| OR | contains | LinkedInBot |
| OR | contains | Googlebot |
| OR | contains | Bingbot |
| **🔒 Action** | **Skip** | |
| **🔄 Placement**| **First** | |
### ✅ **📜 Copyable Code Format**
```
Rule Name: CAPTCHA SKIP
Field: User Agent
Operator: contains
Value: facebookexternalhit
OR
Field: User Agent
Operator: contains
Value: TwitterBot
OR
Field: User Agent
Operator: contains
Value: LinkedInBot
OR
Field: User Agent
Operator: contains
Value: Googlebot
OR
Field: User Agent
Operator: contains
Value: Bingbot
Action: Skip
Placement: First
```
### ✅ **📖 Detailed Explanation**
- **🎯 Purpose**: This rule allows legitimate search engine bots to access your website **without being blocked** by CAPTCHA.
- **📌 Field**: `User Agent` checks if the visitor is a bot.
- **⚙️ Operator**: `contains` applies if the bot’s name appears.
- **📥 Values**: Recognized search bots like `Googlebot`, `Bingbot`, etc.
- **🔒 Action**: `Skip` allows these bots to bypass security checks.
- **🔄 Placement**: This rule should be **first** in order.
---
## **2️⃣ COUNTRY BLOCK Rule (Blocking Specific Countries) 🌍**
### ✅ **📋 Table Format**
| **📌 Field** | **⚙️ Operator** | **📥 Value** |
|-----------|------------|-------------------|
| Country | equals | United Kingdom |
| OR | equals | United States |
| **🔒 Action**| **Block** | |
| **🔄 Placement**| **After CAPTCHA SKIP** | |
### ✅ **📜 Copyable Code Format**
```
Rule Name: COUNTRY BLOCK
Field: Country
Operator: equals
Value: United Kingdom
OR
Field: Country
Operator: equals
Value: United States
Action: Block
Placement: After CAPTCHA SKIP
```
### ✅ **📖 Detailed Explanation**
- **🎯 Purpose**: Blocks traffic from selected countries to **prevent fraud or unwanted access**.
- **📌 Field**: `Country` checks the visitor’s location.
- **⚙️ Operator**: `equals` applies only to the listed countries.
- **📥 Values**: `United Kingdom`, `United States` (can add more if needed).
- **🔒 Action**: `Block` denies access to these users.
- **🔄 Placement**: Should be **after the CAPTCHA SKIP rule**.
---
## **3️⃣ CAPTCHA ON Rule (Adding Verification for Suspicious Traffic) 🔐**
### ✅ **📋 Table Format**
| **📌 Field** | **⚙️ Operator** | **📥 Value** |
|-----------|------------|-------------------|
| Hostname | wildcard | mail.kamrul.us |
| OR | wildcard | kamrul.us/SOFT |
| OR | wildcard | kamrul.us |
| **🔒 Action**| **Managed Challenge** | |
| **🔄 Placement**| **After COUNTRY BLOCK** | |
### ✅ **📜 Copyable Code Format**
```
Rule Name: CAPTCHA ON
Field: Hostname
Operator: wildcard
Value: mail.kamrul.us
OR
Field: Hostname
Operator: wildcard
Value: kamrul.us/SOFT
OR
Field: Hostname
Operator: wildcard
Value: kamrul.us
Action: Managed Challenge
Placement: After COUNTRY BLOCK
```
### ✅ **📖 Detailed Explanation**
- **🎯 Purpose**: Protects sensitive pages by forcing visitors to pass a CAPTCHA challenge.
- **📌 Field**: `Hostname` applies the rule to specific site sections.
- **⚙️ Operator**: `wildcard` matches similar URLs.
- **🔒 Action**: `Managed Challenge` presents CAPTCHA verification.
- **🔄 Placement**: Runs **after COUNTRY BLOCK rule**.
---
## 🔍 **Final Verification & Troubleshooting**
### ✅ **How to Check if Rules Are Working?**
1. **🛠️ Test the site from different locations** (use VPN for testing country blocks).
2. **🔍 Use browser developer tools** (F12 > Network > Inspect HTTP headers).
3. **📊 Check Cloudflare Security Logs** (Security > WAF > Logs).
---
## 🏆 **License & Contact**
This guide is open-source under the MIT License.
For further support, contact **kamrul.us Admin** or visit [Cloudflare Support](https://support.cloudflare.com/).
