WordPress was locked down and Cloudflare was fixed end-to-end.

The Problem

A WordPress site owner wanted Cloudflare configured properly across DNS, WAF, SSL, DDoS protection and bot filtering. They also wanted wp-admin restricted to themselves, so anyone else trying to access it would be stopped before the WordPress login page even loaded.

A previous DNS migration had also left several records missing or incorrectly configured, causing intermittent routing problems. The goal was to build one clean setup where traffic protection, access control and DNS all worked together.

The Findings

The wp-admin login page was publicly accessible, leaving it exposed to credential stuffing and brute-force attempts. There were no WAF rules filtering traffic at the edge and no bot-filtering layer protecting the origin.

The Fix

I configured Cloudflare across the site, covering DNS, WAF, SSL and DDoS protection. I then created WAF rules based on the site's traffic patterns instead of relying on broad, unnecessary blocks.

For bot protection, I added rules to filter hostile user agents and suspicious data-center ASNs before those requests could reach the WordPress server.

The main access change was Cloudflare Zero Trust Access. I placed both /wp-admin and /wp-login behind email verification, so only the owner's approved identity could reach the WordPress login area.

The Result

wp-admin is now protected by Cloudflare Access, with email verification required before the WordPress login page can even be reached. Everyone else is blocked at the edge.

The site now has Cloudflare WAF, DDoS protection, bot filtering, and properly configured DNS and SSL working together. The broken migration records were repaired, restoring normal routing.

The final configuration was documented so the owner can maintain the Cloudflare setup independently. The result is a security layer that stops unwanted traffic before it reaches WordPress while keeping the owner's own access simple.