RopelineFree tool
Cloudflare rules for WordPress and WooCommerce
Your site is behind Cloudflare and every guide says "add a WAF rule" without giving you one. Answer three questions and copy the rules that fit. They're made for Cloudflare's free plan: 5 custom rules and 1 rate limiting rule.
Where the rules go
In Cloudflare, open your site, then Security, then Security rules (in the older dashboard: Security, WAF). Create each rule below, click Edit expression, paste the expression, pick the action and deploy it. Cloudflare's free plan can't log a rule without acting on it, so read "What it can break" first.
1. Challenge the login page
Custom rule · Action: Managed Challenge
(http.request.uri.path eq "/wp-login.php")What it does: people get a quick check, usually automatic, before the login page. Bots that send passwords straight to /wp-login.php can't pass it.
What it can break: apps or scripts that log in to /wp-login.php by themselves. If a plugin moved your login page, use that page's path instead. Customers who log in on WooCommerce's My Account page aren't affected: that form posts to the My Account page.
2. Block XML-RPC
Custom rule · Action: Block
(http.request.uri.path eq "/xmlrpc.php")What it does: closes an old door bots use to guess passwords and send spam.
What it can break: Jetpack, the WordPress mobile app and some publishing tools, which still use it. More in the XML-RPC guide.
2. Keep XML-RPC, count its wrong passwords
Jetpack and the mobile app need XML-RPC, so don't block it at Cloudflare. Limit the passwords tried through it instead: the free Ropeline plugin counts XML-RPC's wrong passwords together with the login page's, so a guesser is locked out of both while Jetpack keeps working.
3. Slow down checkout bots
Rate limiting rule (your free plan's one) · Action: Block
(http.request.uri.path eq "/wp-json/wc/store/v1/checkout")- With the same characteristics: IP
- When rate exceeds: 10 requests per 10 seconds
- Then: Block, for 10 seconds (on the free plan both are 10 seconds)
What it does: the checkout block sends every order to this address. A script that fires card after card from one address gets stopped for 10 seconds at a time.
Why 10 and not 3: while a real shopper fills in the checkout, the block also sends updates to the same address, and the free plan can't tell an update from an order. 10 in 10 seconds leaves room for a real shopper.
What it can't do: bots that switch addresses get through, and it can't tell a declined card from a real order. If your site uses plain permalinks (Settings, Permalinks, Plain), the checkout's address is different and this rule won't match.
3. The classic checkout: not on the free plan
The classic checkout sends orders to ?wc-ajax=checkout, which is in the query string, and the free plan's rate limiting rule can only match the path. A custom rule that challenges it would break checkout for everyone, because the checkout sends orders in the background and a challenge can't show there. Use your one rate limiting rule elsewhere, and guard the classic checkout in WordPress (below).
Where Cloudflare stops and WordPress takes over
Cloudflare sees requests. It doesn't see what happens to a payment, so it can't tell a card tester, whose cards keep getting declined, from a shopper. That's the check that stops card testing: counting failed payments, per address, per email and across the whole store, and during an attack only taking orders from shoppers who opened your checkout page.
That's what Ropeline Pro does inside WooCommerce, on the checkout block, the classic checkout and pay-for-order pages. It trusts Cloudflare's addresses out of the box, so it sees each shopper's real address behind Cloudflare. The card testing guide has the free steps too.
Store plan: a free week, no card, then $15 a month for stores with up to 500 orders a month ($39 up to 3,000, $99 for any size).
Install in a few minutes. Cancel anytime and your site keeps the free plugin.
Start a free week, no card Check my store freeMade for Cloudflare's free plan as of October 2026. Cloudflare names its menus differently from time to time; the rules themselves don't change.