Your WordPress login page is one of the most targeted spots on your website. Every day, bots and hackers try to break into sites through wp-login.php. If you run a small website, you need a simple and strong way to stop these attacks. Cloudflare WAF rules for WordPress login give you that protection. This guide shows you how to set them up step by step. You do not need to be a tech expert. If you can follow simple instructions, you can do this.
Quick Answer: Protect Your WordPress Login in 5 Minutes
If you want the fastest path to securing your WordPress login, start here. These Cloudflare WAF rules for WordPress login will block most bad traffic right away.
Recommended Cloudflare WAF Rule Expression
Use this expression in your Cloudflare WAF custom rule:
(http.request.uri.path contains "wp-login.php" or http.request.uri.path contains "xmlrpc.php") and not ip.src in {your_ip_address}
This rule targets the login page and the XML-RPC file. It also lets your own IP address pass through without any challenge.
Best Action: Managed Challenge vs Block
For most small websites, choose Managed Challenge as your action. A managed challenge shows a check to prove the visitor is human. This stops bots but lets real people through. Use Block only if you see heavy attack traffic. Block stops all requests that match the rule, even from real users who are not whitelisted.
Critical Exceptions You Must Add
Before you save any Cloudflare WAF rules for WordPress login, add these exceptions:
- Your own IP address so you never get locked out
- The admin-ajax.php path so plugins keep working
- The wp-json path so the REST API stays open
- Any IP addresses used by your team or services
Why Small WordPress Sites Need Cloudflare WAF Rules for Login Protection
The 2026 WordPress Security Landscape
WordPress powers over 40% of all websites. That makes it a big target. In 2026, brute-force attacks on login pages are more common than ever. Bots scan the internet all day looking for wp-login.php pages. They try thousands of username and password combos each minute. Small sites are not safe just because they are small. Bots do not care about your traffic size.
Common Attack Vectors Targeting wp-login.php
Here are the main attacks you face:
- Brute-force login attacks: Bots try many passwords on your login form.
- Credential stuffing: Hackers use leaked passwords from other sites.
- XML-RPC abuse: The xmlrpc.php file lets bots send many login attempts in one request.
- Bot scraping: Bots map your login page to find weaknesses.
Benefits Over Traditional Security Plugins
Security plugins like Wordfence run on your server. They use your server resources to check each request. Cloudflare WAF rules for WordPress login work at the edge. This means bad traffic gets stopped before it ever reaches your server. Your site stays fast, and your server handles less load.
| Feature | Security Plugin | Cloudflare WAF Rules |
|---|---|---|
| Blocks traffic before server | No | Yes |
| Uses server resources | Yes | No |
| Global protection | No | Yes |
| Free tier available | Limited | Yes |
Prerequisites Before Creating Cloudflare WAF Rules
Verify Your Site is Proxied Through Cloudflare
Your site must use Cloudflare DNS with the proxy turned on. Go to your DNS settings in Cloudflare. Check that the cloud icon next to your domain is orange. An orange cloud means traffic flows through Cloudflare. A grey cloud means traffic goes direct to your server. WAF rules only work on proxied traffic.
Required Access Levels and Permissions
You need two things:
- Admin or editor access to your Cloudflare account.
- Admin access to your WordPress dashboard.
If someone else manages your Cloudflare account, ask them for help. You can also find your public IP address by searching “what is my IP” on Google.
Backup Your Current Security Configuration
Before you add any Cloudflare WAF rules for WordPress login, take a backup. Go to Security → WAF in Cloudflare. Take screenshots of your existing rules. If something goes wrong, you can undo your changes. Also, make sure you know your WordPress admin login details. Keep them in a safe place.
Step-by-Step: Create Cloudflare WAF Rules for WordPress Login
Step 1: Navigate to Security → WAF → Custom Rules
Log in to your Cloudflare dashboard. Select your website from the top menu. Click on Security in the left sidebar. Then click WAF. You will see a tab called Custom rules. Click on it. This is where you will create your new rule.
Step 2: Write the Rule Expression for wp-login.php
Click the Create rule button. Give your rule a clear name like “Protect WordPress Login”. Now you need to write the rule expression. Here are three options based on your needs.
Basic Expression for Login Page
This is the simplest Cloudflare WAF rule for WordPress login protection:
http.request.uri.path contains "wp-login.php"
This expression matches any request to the WordPress login page. It is a good starting point for most small sites.
Advanced Expression Including wp-admin
If you want to protect the whole admin area, use this:
http.request.uri.path contains "wp-login.php" or http.request.uri.path contains "wp-admin"
This covers both the login page and the admin dashboard. Be careful with this one. It may challenge logged-in users if cookies expire.
Expression for XML-RPC Protection
XML-RPC is a common attack vector. Add this expression to block it:
http.request.uri.path contains "xmlrpc.php"
Most small WordPress sites do not need XML-RPC. If you do not use the WordPress mobile app or Jetpack, you can block this file safely.
Step 3: Choose the Right Action: Block vs Challenge
After you write the expression, pick an action. Here is a simple guide:
- Managed Challenge: Best for most sites. Shows a check page to prove the visitor is human.
- JS Challenge: Runs a quick JavaScript test. Faster than managed challenge but easier for bots to pass.
- Block: Stops all matching traffic. Use this only for clear attack patterns.
- Log: Records the request but takes no action. Use this to test before going live.
Step 4: Set Rule Priority and Ordering
Cloudflare checks WAF rules from top to bottom. Your WordPress login protection rule should sit above general rules. But it should sit below any whitelist rules. This order makes sure your exceptions get checked first.
Step 5: Save and Deploy Your Cloudflare WAF Rule
Click Deploy to save your rule. Cloudflare activates it right away. There is no wait time. Your WordPress login page is now protected by Cloudflare WAF rules.
Critical Exceptions for Cloudflare WAF Rules on WordPress
Exclude admin-ajax.php to Prevent Breaking Plugins
Many WordPress plugins use admin-ajax.php to work. This file lives at /wp-admin/admin-ajax.php. If you block or challenge the whole wp-admin path, you must add an exception for this file. Add this to your rule expression:
and not http.request.uri.path contains "admin-ajax.php"
Whitelist Your IP Address for Uninterrupted Access
You do not want to see a challenge page every time you log in. Add your IP address as an exception. Use this in your rule:
and not ip.src in {xxx.xxx.xxx.xxx}
Replace the x’s with your real IP address. You can find it at whatismyip.com.
Allow REST API Endpoints for Mobile Apps
If you use a mobile app or a headless setup, you need the REST API. The REST API lives at /wp-json/. Add this exception:
and not http.request.uri.path contains "wp-json"
Handle WooCommerce and E-commerce Checkout
WooCommerce uses AJAX calls during checkout. If you run an online store, make sure your Cloudflare WAF rules for WordPress login do not block checkout paths. Add exceptions for:
/wc-ajax//checkout//cart/
Exception Order: Why Precedence Matters
Cloudflare reads rules from top to bottom. Put your whitelist and exception rules above your block or challenge rules. This way, good traffic gets through before the WAF checks for bad traffic. Wrong order is the most common mistake with Cloudflare WAF rules for WordPress login.
Test Your Cloudflare WAF Rules Before Going Live
Use Incognito Mode to Simulate New Visitors
Open a private or incognito browser window. Go to your site’s login page at yourdomain.com/wp-login.php. You should see a Cloudflare challenge page. This means your rule is working. If you see the normal login page, check your rule expression for errors.
Check Security Events in Cloudflare Dashboard
Go to Security → Events in Cloudflare. This page shows all requests that your WAF rules have acted on. You can see which IPs got blocked or challenged. Look for patterns. If you see your own IP, you need to fix your exception.
Verify Legitimate Admin Access Still Works
Log in to your WordPress admin from your whitelisted IP. Make sure you can access the dashboard, edit posts, and use plugins. If anything breaks, check your exception rules. The most common issue is blocking admin-ajax.php by accident.
Monitor for False Positives in First 48 Hours
Watch the Security Events page closely for the first two days. A false positive means a real user got blocked or challenged. If you see false positives, adjust your rule expression or add more exceptions. Cloudflare WAF rules for WordPress login need a bit of tuning at first.
Troubleshooting Common Cloudflare WAF Rule Mistakes
“I’m Locked Out of My Own Site”
This is the most common problem. If you cannot access wp-login.php, follow these steps:
- Open Cloudflare dashboard from a different browser or device.
- Go to Security → WAF → Custom rules.
- Find your login protection rule and click Disable.
- Log in to WordPress and fix your IP exception.
- Re-enable the rule.
Always add your IP exception before you deploy the rule next time.
“My Plugin Stopped Working After Adding Rules”
If a plugin breaks after you add Cloudflare WAF rules for WordPress login, the issue is likely admin-ajax.php. Many plugins use AJAX calls that go through the wp-admin path. Add an exception for admin-ajax.php as shown above. If the problem continues, check the Security Events page to see which path got blocked.
“The Rule Isn’t Blocking Any Attacks”
If you see no events in the Security page, check these things:
- Is your DNS proxy status orange (proxied)?
- Is the rule enabled?
- Is the expression correct? Check for typos.
- Are attacks hitting a different path than your rule targets?
“How to Fix Rule Conflicts with Other Security Rules”
If you have multiple WAF rules, they may conflict. Review all your custom rules. Make sure exception rules sit above block rules. Use the rule order feature in Cloudflare to drag rules into the right position.
When to Use Log Mode vs Active Mode
When you are not sure about a rule, set the action to Log first. Log mode records matching requests but does not block or challenge them. After 24 hours, check the Security Events page. If the rule catches what you expect, switch it to Managed Challenge or Block.
Advanced Cloudflare WAF Configurations for Different WordPress Sites
Solo Bloggers: Simple Protection Setup
If you run a personal blog, keep it simple. Use one rule that targets wp-login.php and xmlrpc.php. Set the action to Managed Challenge. Add your home IP as an exception. This setup takes five minutes and stops most attacks.
Small Agencies: Multi-Site Management
If you manage several WordPress sites, use the same rule expression on each site. You can also use Cloudflare account-level rules if all sites are under one account. This saves time. Keep a list of all office IP addresses for whitelist exceptions.
E-commerce Stores: Balancing Security and UX
Online stores need careful WAF setup. You want to stop attacks but not slow down checkout. Use Managed Challenge on wp-login.php and xmlrpc.php. Add exceptions for all WooCommerce AJAX paths. Test checkout in incognito mode after each change. Cloudflare WAF rules for WordPress login on e-commerce sites need more exceptions than blogs.
Membership Sites: Handling User Registrations
Membership sites let users register and log in. You cannot block the login page completely. Use Managed Challenge instead of Block. Add exceptions for the registration page path. If you use BuddyPress or MemberPress, check which paths they use for login and registration.
FAQ: Cloudflare WAF Rules for WordPress Login
Do I Need the Pro Plan for WAF Rules?
No. Cloudflare offers custom WAF rules on the free plan. You can create up to five custom rules for free. The Pro plan gives you more rules and advanced features. For most small WordPress sites, the free plan is enough to set up basic Cloudflare WAF rules for WordPress login protection.
Will This Affect Site Speed?
No. Cloudflare WAF rules add almost zero latency. Cloudflare checks the rule expression at the edge, which takes less than a millisecond. Your site may even get faster because bad traffic never reaches your server.
Can I Use This with Wordfence or Other Security Plugins?
Yes. Cloudflare WAF rules for WordPress login work well with security plugins. Cloudflare stops bad traffic before it hits your server. Wordfence catches anything that gets through. Using both gives you layered protection.
How Often Should I Update My WAF Rules?
Review your rules every three months. Check the Security Events page for new attack patterns. If you change your IP address, update your whitelist. If you add new plugins, check that they still work with your rules.
What’s the Difference Between Custom Rules and Managed Rules?
Custom rules are rules you write yourself. You control the expression and the action. Managed rules are made by Cloudflare. They update automatically to fight new threats. Custom rules give you more control. Managed rules give you hands-off protection. Use both for the best results.
Conclusion: Keep Your WordPress Login Secure with Cloudflare WAF
Setting up Cloudflare WAF rules for WordPress login is one of the best things you can do for your site security. It takes less than ten minutes. It stops brute-force attacks, bot traffic, and XML-RPC abuse. Your site stays fast because bad traffic never reaches your server.
Here is what to do next:
- Log in to Cloudflare and go to Security → WAF → Custom rules.
- Create a new rule targeting wp-login.php and xmlrpc.php.
- Set the action to Managed Challenge.
- Add your IP address as an exception.
- Add exceptions for admin-ajax.php and wp-json.
- Deploy the rule and test in incognito mode.
- Check Security Events for the first 48 hours.
Start with these steps. Then explore advanced rules as you learn more. Your WordPress login will be much safer with Cloudflare WAF rules in place.