Active Magento attacks bypassed the existing WAF.
How I audited 7 Cloudflare zones, stopped active Magento exploitation attempts, and cut unwanted bot traffic by 70%.
A Magento 2 store was being hit by aggressive bots and active attempts to exploit a known file-upload vulnerability. The existing Cloudflare setup looked protected on the surface, but important rule-order, DNS, API, and bot-control gaps were letting attackers through. I audited all 7 Cloudflare zones, corrected the WAF logic, protected exposed endpoints, and cut unwanted bot traffic by 70%.
The Situation
A Magento 2 store was being hit heavily by bots from cloud networks such as Azure, Tencent, and Alibaba. At the same time, attackers were probing a known Magento file-upload vulnerability. The existing Cloudflare rules were doing some useful filtering, but important gaps were allowing too much traffic through.
The main crawler-blocking rule had a 98% bypass rate. A duplicate Magento storefront had no custom firewall protection at all, while several origin IPs were exposed through unproxied DNS records. The result was a security setup that looked active but left several important paths and domains exposed.
What I Found
The logs showed active exploitation, not just ordinary bot traffic. Attackers were hitting /customer/address_file/upload, linked to CVE-2025-54236, and probing for the webshell filename bf7721e2f928.php. I also found a probe for the older CVE-2019-7816 ColdFusion vulnerability.
What I Did
I started with a read-only Cloudflare API audit across all 7 zones and collected 186 JSON configuration artefacts. I then pulled 14 days of firewall history (29,991 events) followed by a 24-hour unsampled pull of 36,249 events. I correlated attacker IPs across the zones, mapped exposed origin records through DNS enumeration, and used Nuclei to identify 37 vulnerability findings.
Each zone received 10 custom Cloudflare rules. The core protections locked down PHP webshell paths under /media/, blocked high-risk ASNs including Alibaba 45102 and Tencent 132203, and protected endpoints such as /media/custom_options/, /pub/media/, and /customer/address_file/upload.
I also blocked clearly outdated or suspicious user-agent patterns such as python-requests, Windows NT 5.1, macOS 10_9_3, and Firefox/72.0, and added REST API rate limiting for /rest/V1/guest-carts.
How It Landed
Once the new rules were active, the identified attack patterns were blocked at the edge before reaching Magento. Webshell probes against /customer/address_file/upload began returning 403 responses through the user-agent rule, while Tencent scrapers received either 403 blocks or a Managed Challenge.
Overall bot traffic dropped by 70%. The primary zone went from around 22,000 Cloudflare requests per day to roughly 186 real-user requests per day. The geolocation rule filtered 35% of suspicious traffic during a 24-hour window, producing 1,920 hard blocks and 1,020 challenges.
Most importantly, the crawler-block rule that had been bypassed 98% of the time started working once the verified-bot logic was corrected and placed in the right order. The result was a WAF that could separate trusted bots, suspicious automation, and active attack traffic instead of treating them all the same.
Client Feedback
“They delivered an outstanding security audit that went well above and beyond the scope of the engagement. They analysed over 66,000 firewall events across all 7 of our domains, identified active exploitation attempts we were not aware of, and delivered a detailed, evidence-backed report with clear recommendations. Their communication was excellent throughout and their technical knowledge of Cloudflare WAF is first class. The M2 implementation plan they produced is thorough and ready to execute. I would not hesitate to rehire them for future security work and highly recommend them to anyone needing serious Cloudflare WAF expertise.”