內容簡介
WP WAF Manager 將整個 Cloudflare 設定整合進入 WordPress，讓使用者能夠輕鬆部署安全規則、管理 DNS、監控流量、清除快取、封鎖 IP 及設置電子郵件轉發，無需進入 Cloudflare 控制台。
【主要功能】
• 一鍵部署五個預設安全規則
• 完整的 DNS 記錄管理
• 監控所有 Cloudflare 區域狀態
• 客戶管理與報告發送功能
• 支援多區域部署與 JSON 匯入匯出
外掛標籤
開發者團隊
原文外掛簡介
This is the WordPress.org edition, and it contains the WAF Rules Builder only.
The full version, WP WAF Manager, adds DNS management, zone analytics, zone controls and cache purge, bot control, SSL monitoring, Cloudflare alerts and health checks, Turnstile widget management, Page Rules migration, IP access rules, security events, email routing, white-label client reports, and multi-account support. It is available free on GitHub, or from wpwafmanager.com for automatic updates and priority support. The full version is fully compatible with this edition and runs on the same site.
WAF Manager for Cloudflare deploys a proven set of Cloudflare WAF (Web Application Firewall) custom rules to your Cloudflare zones from your WordPress admin. You choose what each rule allows, blocks or challenges with checkboxes, and the plugin writes the Cloudflare expressions and deploys them in the correct order.
The five rules
Based on the open-source wafrules.com ruleset, updated to the October 24, 2026 release:
Allow Good Bots (Skip). Allows every Cloudflare verified bot, or only the categories you pick, plus services matched by the IP lists they publish (ManageWP, WP Umbrella, ShortPixel, Patchstack and more), Let’s Encrypt, your own server IPs, an IP allowlist, custom user agents and custom Cloudflare expressions. It runs first so nothing below blocks legitimate traffic, while Cloudflare’s managed rules still protect it.
Block Aggressive Crawlers & WordPress Paths (Block). Blocks aggressive crawlers and exploit scanners (SQLMap, Nikto, Masscan, Nmap), generic bot patterns, curl scripts (with an exception list for your API and webhook hostnames), and sensitive WordPress paths (xmlrpc.php, wp-config, install.php, readme.html, license.txt) in any letter case.
Block or Challenge Web Hosts / TOR & Exploit URIs. Blocks or challenges traffic from hosting and VPS networks (DigitalOcean, Linode, Vultr, Hetzner, OVH, Contabo and more), three networks known for WordPress attack traffic and TOR exit nodes, and blocks six groups of exploit URIs: time-delay and UNION SQL injection, file inclusion, legacy exploits, other CMS probes and XSS.
Challenge Large Providers / Country (Managed Challenge). Challenges traffic from AWS, Google Cloud and Azure, and optionally visitors from outside the countries you select.
Challenge VPN Connections & wp-login (Managed Challenge). Challenges known VPN providers and protects the WordPress login page.
Each rule can be switched on or off and fine-tuned without writing any Cloudflare syntax.
Builder features
Live expressions: the Expressions tab shows the exact Cloudflare expression each rule will deploy, with its length against Cloudflare’s 4,096-character limit. A deploy stops with a clear message before sending a rule that is too long.
Custom Allow Expressions: add your own Cloudflare rules language expressions to Rule 1 for cases the built-in allowlists don’t cover, such as webhook paths or Cloudflare managed IP lists.
Deploy to one zone or many: pick any zones in your Cloudflare account and deploy to all of them at once.
Keeps your own rules: deploying replaces only this plugin’s rules and keeps any other custom rules on the zone after them. A “Replace all custom rules” option clears the zone when you want a clean start.
Zone Rules tab: see the custom rules currently live on any zone.
Free plan compatible: when Cloudflare restricts a rule phase on your plan, the plugin removes it and retries so the deploy still succeeds.
Export, import and reset: save your configuration as a JSON file, load it on another site, or reset everything to the defaults.
Settings
Minimum role that can use the plugin (Administrator recommended)
Allowlist of specific administrators who can access the plugin
Keep or delete plugin data on uninstall (kept by default)
Test Connection to check your Cloudflare credentials
Requirements
WordPress 6.0 or later
PHP 8.0 or later
A Cloudflare account with at least one active zone
An API Token with Zone > WAF > Edit and Zone > Zone > Read, or your account email and Global API Key
External services
This plugin connects to the Cloudflare API to read your zones and to create, read, and deploy WAF rules on your behalf. This service is required for the plugin to function: without a Cloudflare account and API credentials, the plugin has nothing to manage.
Requests are sent to the Cloudflare API at https://api.cloudflare.com only from your WordPress admin, and only when you take an action that requires it: verifying credentials, testing the connection, listing your zones, listing existing rules, or deploying rules.
The data sent consists of the Cloudflare credentials you enter (an API Token, or an account email plus Global API Key), the zone IDs you select, and the WAF rule definitions you build in the plugin. No data about your site’s visitors and no personal data about your WordPress users is sent. The plugin does not send data to any other third-party service.
Cloudflare is a third-party service operated by Cloudflare, Inc. By using this plugin to connect to Cloudflare, you are subject to their terms and policies:
Terms of Service: https://www.cloudflare.com/terms/
Privacy Policy: https://www.cloudflare.com/privacypolicy/
Trademarks
This plugin is independent and is not affiliated with, endorsed by, or sponsored by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc., referenced here only to describe what this plugin is compatible with. No endorsement or affiliation is implied.
