WAF rules and Bot Fight Mode: protect your site on Cloudflare

You open your analytics on a Monday and see 3,000 new visits to your contact page. None of them wrote on WhatsApp. They were bots probing routes, and your site spent resources serving them while your real customers waited.

Cloudflare gives you two tools for this, and both come included on the free plan.

What are WAF custom rules?

They are filters you write to decide what to do with each visit: let it through, challenge it or block it. According to Cloudflare's documentation, each rule has an expression that describes the traffic and an action applied when it matches. Rules are evaluated in order, and a Block action stops the evaluation of the rules that follow.

If your site is not on Cloudflare yet, start with what the free plan includes.

How many rules does each plan include?

The free plan includes up to 5 custom rules per zone. The same Cloudflare documentation details the limits of each plan:

Plan	Custom rules	Regex
Free	5	No
Pro	20	No
Business	100	Yes
Enterprise	1.000	Yes

Five rules are enough for a corporate site if you choose them well. Available actions include Block, Managed Challenge and Skip.

Which rules should you create first?

The ones that protect your admin area and stop traffic that is no use to you. In its use cases, Cloudflare lists examples such as requiring known IP addresses in the admin area, challenging bad bots, blocking traffic by country or blocking requests by attack score.

For a business with customers in Colombia, the USA and Spain, a good first rule is to challenge access to your admin panel from outside your usual locations. The second can be to challenge bad bots on the routes that receive the most spam. If you also use forms, combine this with Cloudflare Turnstile.

Common mistake: using the Block action on a country rule without checking your data. If a customer travels or buys from that country, they are locked out and you never find out. Start with Managed Challenge and switch to Block only when you confirm the traffic is not yours.

What is Bot Fight Mode and how is it different?

It is a free Cloudflare feature that detects traffic matching known bot patterns and imposes resource-expensive challenges on it. According to the Bot Fight Mode documentation, it protects the whole domain, without limiting itself to certain paths, and cannot be adjusted with WAF custom rules: the Skip, Bypass and Allow actions have no effect on it.

To turn it on, go to the dashboard, open Security Settings, filter by Bot traffic and switch on Bot fight mode. Cloudflare warns that it may challenge API or mobile app traffic. If you have your own integrations, such as a webhook that connects your CRM, test them after turning it on.

How do I test a rule without losing customers?

Start with the Managed Challenge action and review your traffic for a few days. A real visitor passes the challenge and keeps browsing, while a bot usually gets stuck. Note how many requests fall under each rule and compare them with your WhatsApp conversations from the same days: if your customer numbers do not drop, the rule is well tuned.

What about managed rules?

They are rule sets that Cloudflare maintains for you against known attacks. The managed rules documentation states that the Free Managed Ruleset is available on all Cloudflare plans. You do not have to write them: your job is to check that they stay active and do not clash with your own rules.

If what worries you is which AI bots come in to read your content, that is controlled with a different file: see which AI bots to allow and which to block in robots.txt.

In short

Those 3,000 ghost visits are not fixed with panic, but with one or two well-thought-out rules. Turn on Bot Fight Mode, create your first rules with Managed Challenge and review your traffic before switching to Block. If you would rather have someone set it up for you, see our hosting and domains service.