Security headers
Cloudflare Edge Hardening Guide: WAF, Bot Fight & Rate Limiting (2026)
Step-by-step Cloudflare edge hardening: Web Application Firewall (WAF) custom rules, Bot Fight Mode, Rate Limiting, and TLS 1.3 encryption.
Data reviewed October 24, 2026
Routing your domain traffic through Cloudflare provides edge protection before malicious requests ever reach your origin server. Configuring WAF custom rules, Bot Management, and TLS settings shields your web properties against Layer 7 DDoS attacks, brute-force login attempts, and scrapers.
| Cloudflare Feature | Recommended Value | Threat Mitigated |
|---|---|---|
| SSL/TLS Encryption Mode | Full (Strict) | Man-in-the-middle origin sniffing |
| Minimum TLS Version | TLS 1.2 or 1.3 | Deprecates obsolete TLS 1.0/1.1 protocols |
| Bot Fight Mode | Enabled | Automated scrapers and bad bot swarms |
| Security Level | Medium or High | Challenges suspicious IP reputation scores |
Enforcing TLS 1.3 & Minimum SSL Standards
Set Minimum TLS Version to 1.2 or 1.3 in Cloudflare SSL/TLS settings, and enable Automatic HTTPS Rewrites and Opportunistic Encryption.
Custom WAF Rules for Admin Path Protection
Construct a custom WAF rule that challenges or blocks any visitor attempting to access administrative directories (/wp-admin, /admin, /api/auth) who does not originate from your designated static office IP or ASN.
Bot Fight Mode & Rate Limiting
Activate Bot Fight Mode to challenge known malicious scrapers and search engine spoofers. Deploy rate limiting on login and search endpoints to stop credential stuffing attacks.
Frequently asked questions
- Why is SSL "Full (Strict)" mode required in Cloudflare?
- Full (Strict) validates that your origin server holds a legitimate, trusted SSL certificate, preventing attackers from intercepting traffic between Cloudflare and your origin.
- Will Bot Fight Mode block Googlebot?
- No. Cloudflare maintains a verified list of legitimate search engine bots (Google, Bing, Apple) that bypass challenge rules.