How to secure WordPress with Cloudflare
WordPress sites are frequent targets because they combine public login pages, plugins, and dynamic requests that attackers can probe at scale.
Cloudflare adds a protective layer in front of your site, reducing abuse before it reaches your origin server.
This guide explains how to secure WordPress with Cloudflare using practical settings that improve protection without breaking normal traffic.
You will see which controls matter most for login security, SSL, performance, and bot mitigation.
Why Cloudflare works well for WordPress
Cloudflare sits between visitors and your hosting provider as a reverse proxy.
That means requests first pass through Cloudflare’s network, where they can be filtered, cached, challenged, or blocked before they reach WordPress.
For WordPress, this is useful because common attack patterns often focus on predictable paths such as /wp-login.php, /wp-admin, and /xmlrpc.php.
Cloudflare can help reduce password attacks, limit abusive requests, and hide your origin IP from casual scanning.
- DNS protection hides origin details when configured correctly.
- SSL/TLS controls protect credentials and session data in transit.
- Web Application Firewall filters suspicious requests.
- Rate limiting slows brute-force login attempts and scrapers.
- Bot management reduces automated abuse.
Set up Cloudflare correctly before changing security settings
Security starts with a clean Cloudflare setup.
Add your domain to Cloudflare, update your registrar to use the provided nameservers, and confirm that your DNS records are proxied where appropriate.
In Cloudflare DNS, orange-cloud records route traffic through Cloudflare, while gray-cloud records bypass it.
For WordPress, your website hostname should usually be proxied.
Mail-related records such as MX, SPF, DKIM, and DMARC should remain unproxied because email does not route through Cloudflare’s web proxy.
Verify the origin server configuration
Make sure your hosting server responds correctly before enabling aggressive protection.
Check that WordPress loads over HTTPS, that your web server supports modern TLS, and that your firewall allows Cloudflare IP ranges if you intend to restrict direct access to the origin.
If possible, lock down the origin so only Cloudflare can connect to ports 80 and 443.
This reduces the chance that an attacker can bypass Cloudflare and attack your server directly.
Enable SSL/TLS properly
One of the most important steps in learning how to secure WordPress with Cloudflare is configuring SSL/TLS the right way.
In Cloudflare, use Full (strict) SSL mode whenever your origin has a valid certificate.
This ensures encrypted traffic between the browser, Cloudflare, and your server.
Do not leave the site on Flexible SSL for a production WordPress installation.
Flexible mode encrypts only the browser-to-Cloudflare connection, which can create redirect loops and leaves the Cloudflare-to-origin path unsecured.
- Universal SSL provides browser-facing HTTPS.
- Full (strict) verifies the origin certificate.
- Always Use HTTPS redirects all traffic to secure connections.
- Automatic HTTPS Rewrites can help fix mixed content on some sites.
Protect WordPress login pages
Attackers often target WordPress login forms with credential stuffing and brute-force attempts.
Cloudflare can reduce this pressure by challenging suspicious traffic and limiting request volume to sensitive endpoints.
Create a firewall rule or WAF rule that focuses on /wp-login.php and /wp-admin.
Depending on your site, you can challenge all traffic to those paths, allow only known countries, or require additional verification for repeated login failures.
Use rate limiting for repeated login attempts
Rate limiting is effective because brute-force tools send many login requests quickly.
Set a threshold that blocks or challenges repeated hits to /wp-login.php from a single IP over a short time window.
Be careful not to block legitimate users behind shared networks.
A challenge action is often safer than a hard block for public sites with many visitors.
Consider two-factor authentication at the WordPress level
Cloudflare strengthens the edge, but WordPress account security still matters.
Use strong administrator passwords and add two-factor authentication with a trusted plugin or identity provider.
Cloudflare and WordPress security work best together rather than as replacements for one another.
Reduce exposure from XML-RPC and REST abuse
WordPress includes features that attackers can abuse if left open without control.
The XML-RPC endpoint is commonly targeted for login attempts and amplification behavior, while the REST API can be scraped or probed for user enumeration depending on plugin and theme behavior.
If you do not need XML-RPC, disable it at the application or server level.
If you rely on it for Jetpack, mobile publishing, or remote integrations, protect it with Cloudflare rules that challenge abnormal request patterns.
- Block or challenge excessive POST requests to
/xmlrpc.php. - Inspect REST API traffic for scraping or enumeration spikes.
- Pair Cloudflare rules with plugin hygiene to reduce exposed functionality.
Use the WAF to filter common WordPress attacks
Cloudflare’s Web Application Firewall helps stop known malicious patterns before they reach WordPress.
Managed WAF rules can detect exploitation attempts aimed at outdated plugins, vulnerable themes, traversal payloads, and suspicious POST bodies.
For best results, enable Cloudflare’s managed rules and review the event logs regularly.
False positives can happen, especially on heavily customized sites or membership platforms, so monitor changes after you turn rules on.
What WAF rules are most useful?
- Managed WordPress rules for common CMS-specific threats
- SQL injection and XSS protections for payload filtering
- Known bot signatures for automated scanners
- Geo or ASN restrictions if your audience is region-specific
For high-risk sites, add custom rules that protect admin paths, checkout pages, and registration forms.
The best rules are precise enough to stop abuse without interrupting everyday visitors.
Hide and protect the origin server
A strong Cloudflare setup should make your origin harder to find and harder to reach.
If attackers discover the server IP, they may bypass Cloudflare and attack hosting directly.
Use the following practices to reduce origin exposure:
- Restrict inbound firewall access to Cloudflare IP ranges.
- Use a separate origin hostname that is not published in public DNS.
- Avoid exposing server banners that reveal software versions.
- Keep staging sites private or protected with authentication.
If you operate multiple WordPress sites on one server, this step becomes even more important because a leak on one domain can expose all hosted applications.
Improve caching without weakening security
Cloudflare can cache static assets such as images, stylesheets, JavaScript files, and fonts.
Caching reduces load on WordPress and helps absorb traffic spikes, but you should be selective with HTML caching unless you fully understand the implications for logged-in users and dynamic content.
Use cache rules carefully for public pages, and bypass caching for admin areas, carts, checkout flows, account dashboards, and personalized pages.
WordPress security and performance work together when cache rules are tuned to your site’s behavior.
Useful cache-related settings
- Brotli for efficient compression
- Polish for image optimization on supported plans
- Tiered Cache for improved origin efficiency
- Bypass Cache on Cookie rules for logged-in sessions
Monitor logs, events, and alerts
Security is not finished after setup.
Cloudflare dashboard analytics, firewall events, and security logs show whether threats are being blocked and whether legitimate visitors are being challenged incorrectly.
Watch for unusual spikes in login attempts, XML-RPC requests, 403 responses, and traffic from unfamiliar locations.
If you use Cloudflare Enterprise or log integration tools, export the data to a SIEM or log platform for deeper analysis.
Review WordPress admin activity as well.
If Cloudflare blocks suspicious traffic but someone still logs into an account unexpectedly, the issue may be weak credentials, malware, or an exposed third-party plugin.
Best-practice checklist for WordPress and Cloudflare
- Use Full (strict) SSL/TLS.
- Proxy the main website records through Cloudflare.
- Restrict origin access to Cloudflare IPs when possible.
- Protect
/wp-login.php,/wp-admin, and/xmlrpc.php. - Enable managed WAF rules and review alerts.
- Apply rate limiting to login and abuse-prone endpoints.
- Keep WordPress, plugins, and themes updated.
- Use two-factor authentication for administrators.
- Monitor logs for false positives and emerging threats.
When configured well, Cloudflare becomes a strong front line for WordPress hardening.
The most effective approach combines edge protection, strong application security, and regular monitoring so your site stays resilient as threats change.