How to Set Up Cloudflare WAF Rules and Rate Limiting

Defense at the edge

Cloudflare sits in front of your site, so it can drop bad traffic before it ever reaches your origin. Two features do most of the work: WAF custom rules for matching and blocking, and rate limiting for throttling abuse.

Step 1 — Turn on managed protection

Cloudflare → Security → WAF → Managed rules:

• Enable the Cloudflare Managed Ruleset (OWASP-style signatures).
• Enable Bot Fight Mode (or Super Bot Fight Mode on Pro) to challenge known bots.

These catch automated scanners with zero configuration.

Step 2 — Write a custom rule

Security → WAF → Custom rules → Create rule:

Block traffic to admin paths unless it’s you:

(http.host eq "example.com" and
 http.request.uri.path starts_with "/admin" and
 not ip.src in {203.0.113.10})

Actions: Block for hard stops, Managed Challenge for suspicious-but-maybe- human traffic. Start with Managed Challenge and tighten later.

Step 3 — Add a rate limiting rule

Security → WAF → Rate limiting rules → Create rule:

• If: http.request.uri.path starts_with "/api/"
• Rate: 60 requests per 1 minute
• Action: Block for 1 minute

This is what stops credential stuffing and scripted API abuse. Set thresholds well above human usage — rate limits are a backstop, not a UX feature.

Step 4 — Send security headers

Rules → Transform Rules → Modify Response Header (or a Worker):

Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin

Step 5 — Test, don’t assume

1. Hit the protected path from outside your IP — expect a block/challenge.
2. Fire a burst of /api/ requests — expect 429 after the threshold.
3. Watch Security → Events to confirm your rules (not something else) fired.

Troubleshooting

• Legitimate users blocked — rules match in order; make allowlists (ip.src in {…}) come first, or switch to Managed Challenge.
• Your own IP got blocked — add it to IP Access Rules → Allow.
• Rate limit never triggers — confirm the expression matches your real path and that requests aren’t cached at the edge.

Keep the origin protected too

Edge rules reduce traffic before it reaches your application, but they are not an authorization system. Keep authentication and input validation in the Worker or application as well. Treat Cloudflare expressions as one layer in a defense-in-depth setup, and test them from a client that is not covered by your allowlist.

For an MCP endpoint, start with a deliberately small request budget and separate authentication failures from normal tool calls. The secure MCP server guide explains the application-side checks that belong behind the edge rule.

Summary

You now drop bots at the edge, challenge suspicious requests, throttle API abuse, and ship hardening headers — before traffic reaches your origin. Keep the application’s authentication and validation in place because a WAF rule is not a replacement for either one.