Start
Pick what you are reproducing, then adjust it one rule at a time. Every later step starts from this choice, and nothing leaves this tab.
A builder rule set fills the fields below from a preset and rebuilds each rule as you edit. A release loads the exact expressions that version shipped — edit them directly in steps 2–4.
Preset file
A preset is the option form, not a release: it reproduces what the builder generates.
Trusted traffic
Rule 1 skips rules 2–4. Anything listed here is never blocked or challenged, so keep it short and prefer an account IP list over inline addresses. Skip action
Blocking
Rule 2 blocks outright — no challenge, no page load. Block only paths and networks you are sure nothing legitimate uses. Custom block responses
Challenges
Rules 3 and 4 ask the visitor to prove they are human instead of blocking them: login and admin paths first, then everyone outside your countries. Challenge TTL is set per zone, not here.
Output
Copy the expressions into Security → WAF → Custom rules, send the JSON with
curl, or save a profile for the CLI. All three describe the same rules.
Cloudflare dashboard → your zone → Security → WAF → Custom rules → Create rule. Paste the expression and set the action shown on each card.
Replaces the whole http_request_firewall_custom entry point. Merge any rule whose
ref does not start with lmt- back into the request first.
Upgrade manifest and detection rules
curl
CF_API_TOKEN first.
Same shape as profiles/*.json. Save it and deploy with
./cloudflare-wordpress-rules -d example.com -c create-rules my-profile.