Skip to content
Clodo
Intermediate7 minUpdated: 2026-09-13

Configuring Cloudflare WAF, Rate Limiting, and DDoS Mitigation Rules

Protect websites and public API endpoints from malicious scraper bots, Layer 7 HTTP floods, and credential stuffing.

Verified against

Cloudflare
Free / Pro
SSL mode
Full (strict)
Last checked
2026-09-13

Before you start

  • An active zone in Cloudflare
  • An HTTP/HTTPS service that can be proxied (orange cloud)
  • A valid certificate on the origin (required for Full strict)
On This Page
All Guides
Reading progress

With Orange Cloud active, incoming web traffic is scrubbed at Cloudflare's global edge. Custom WAF rules and Rate Limiting inspect requests in flight, blocking Layer 7 application assaults before touching host infrastructure.

Cloudflare Edge WAF & Layer 7 Scrubbing Pipeline

Step-by-step scrubbing sequence intercepting malicious requests at the global edge.

ARCHITECTURE FLOW
1GİRİŞ
Inbound Web Requests

Legitimate users, indexing spiders, and malicious scanners.

2ANYCAST
Cloudflare Anycast Edge

Volumetric L3/L4 floods are absorbed at the Cloudflare edge closest to the source, before traffic reaches the origin.

3WAF KURALI
WAF & Bot Fight Mode

Drops SQL injection, XSS vectors, and automated headless scrapers.

4HIZ SINIRI
Rate Limiting Engine

Prompts Turnstile challenge to IPs exceeding 60 requests per minute.

5TEMİZ TRAFİK
Clodo Origin Node

Requests that pass the filters reach your server. As long as your origin IP stays hidden, an attacker cannot bypass this step.

1. Top 3 Defensive WAF Rules#

Cloudflare Dashboard > Security > WAF
Kural 1: Login Brute-Force Korumasi
If: (http.request.uri.path contains "/wp-login.php" or http.request.uri.path contains "/api/auth/login")
Then: Managed Challenge (Cloudflare Turnstile)

Kural 2: Bilinen Tehlikeli Tehdit Skorlari
If: (cf.threat_score gt 14)
Then: Interactive Challenge

Kural 3: Rate Limiting (Aşırı İstek Engelleme)
Eşik: 10 saniyede 50'den fazla istek atan IP'leri 1 saat boyunca Block et.
Method Comparison

How to Implement This?

Clodo Control Panel Quick Method

Cloudflare Integration

The Cloudflare integration in the Clodo panel creates the DNS records and origin rule for you when you attach a domain; you then enable the WAF rules from the Cloudflare dashboard.

Where in Panel? Panel > Service detail > 'Domain' card, then connect your Cloudflare account.
Step-by-step Execution:
  1. 1Authorize your Cloudflare account from the Domain card on the service detail page.
  2. 2Pick your zone; the A record and origin rule are created for you and your origin IP stays behind the proxy.
  3. 3Enable WAF, Bot Fight Mode and rate limiting from the Cloudflare dashboard using the steps in this guide.

Was this guide helpful?

Feedback goes straight to the team that maintains this guide.

Related Guides

Portless Minecraft IP with Cloudflare: Configuring DNS A & SRV Records

Complete guide to configuring DNS A and SRV records on Cloudflare so players can join using clean domains.

Initial Security Hardening for Linux VDS/VPS Servers

Essential hardening checklist for fresh Ubuntu/Debian servers: SSH keys, UFW firewall, and fail2ban brute-force defense.