We’re always looking for cost-effective ways to add more layers of security to our WordPress sites. One of the easiest ways to do that is to use a service like Cloudflare, which Linchpin has been utilizing for the last decade.

The free tier of Cloudflare has a lot of benefits that many sites can take advantage of, and you can run through some of these firewall rules on the free tier as well. We do recommend the pro tier ($20/mo) package for even further rules and it’s a great set of features for a relatively small investment.

In this tutorial, I’ll share some basic firewall rules to help further lock down your WordPress install/administrative areas as well as set up certain rules for usage with WooCommerce.

First things first before we get started. You’ll need to have a Cloudflare account, and obviously be utilizing at least the basic DDOS service. If you do not already have an account you’ll want to get that going first. This article does not go into change Nameservers/DNS to utilize Cloudflare. There are tons of articles out there for that information.

Please note that Linchpin is not an official Cloudflare partner and we do have any affiliation or make any income from our usage of Cloudflare. With that being said, away we go…

1. Step 1: Whitelist at least your current IP address

   …along with any additional IP addresses that should have access to the WordPress admin we are about to lockdown. We add our IP address(es) first so we do not inadvertently lock ourselves out of the WordPress admin. If you need your IP address get it using our tools site linchpin.tools/my-ip

   There are a few key options when settings up your rules. Including explicitly whitelisting an IP, IP Range, country, or ASN. While you can set up some exclusions by “country” those types of rules may be better suited to be done within the actual rules vs here in the “tools” area. At minimum, you should whitelist your IP address (or if you use a VPN whitelist that instead-of/as-well)

2. Step 2: Determine what areas we need to lockdown

   Our goal here is to limit the attack vectors typically targeted by bad actors. Since we began with whitelisting our IP address(s) within the previous step. Now we can begin to think about where shady business can possibly take place. Typically we want to lock down wp-admin/ wp-login.php (depending on use case), directly accessing plugins files and xmlrpc to name a few.

3. Step 3: Building our Firewall rules in Cloudflare

4. The firewall rule area of Cloudflare is relatively straight forward. You have 3 key fields.

5. Protecting wp-login.php

6. By far the most targeted area of WordPress is wp-login.php. If your website limits the ability for users to create accounts it may make sense to lock down and limit who can access wp-login.php directly. This can also be useful to lock down if you provide logins through another method (Single Sign On or through another front end form/widget or plugin)
7. Let’s go back to Cloudflare’s Firewall area and now click on “create”.

Even Further Reading

• WooCommerce related caching plugin config
• Another article going over these same basic rules
• WordPress.com, Akismet, Jetpack IP Ranges