Cloudflare WordPress Rules

This repository provides bash scripts for creating Cloudflare WAF rules for WordPress sites, plus helpers for API tokens and Turnstile widgets.

• cfwr.sh — create, update, list and delete WAF custom rules through the Cloudflare Rulesets API, across one zone or many. It runs the stable cfwrv1.sh or the cfwrv2.sh refactor in progress.
• cloudflare-token.sh — create and manage Cloudflare API tokens, including tokens for the Super Page Cache for Cloudflare plugin.
• cloudflare-turnstile.sh — create and manage Turnstile widgets.

Start here

1. Install the scripts and configure ~/.cloudflare.
2. Deploy the stable rules with ./cfwr.sh -d example.com -c create-rules default.
3. Review the command reference and the profile format.

Rules

• Beta rules (staging) — generated from the beta profile on every build.
• Stable rules — the rules the default selector deploys today.
• Profile management — how rule changes move from beta to a numbered release.
• Incidents — situations seen on real sites, with the rule that stopped each one and the requests it must not block.

Requirements at a glance

bash, curl, jq, a Cloudflare account, and an API token with the Rulesets permissions.