Skip to main content

Legacy v2 expressions

The complete rule text from the two v2-era documents, kept verbatim for reference. They were applied through the Firewall Rules API (Filters plus Firewall Rules), which Cloudflare deprecated on 2025-06-15; the v2 profiles and the reasons they are no longer used are described in Legacy v2 rules.

Do not deploy these expressions. The allow and bypass actions and the priority field no longer exist, and the address lists predate the current profile. Use Stable rules for what ships today.

Rules V2​

Version V202 (2024-12-16), with the version history from the document:

Rules V2
## Changelog
### V202 - 2024-12-16
 * Updated WP Umbrella's user agent.
### V201 - 2025-02-05
* Updated R2 to include more blogvault IP's and user agents, missed some from json.
### V2 - 2024-12-16
* Initial version

R1V202 - Block URI Query, URL, User Agents, and IPs (Block)​

* Action: Block 
```
(http.request.uri.path eq "/wp-content/uploads/wp-activity-log/non_mirrored_logs.json") or (http.request.uri.path eq "/xmlrpc.php")
```

R2V202 - Allow URI Query, URL, User Agents, and IPs (Allow)​

* Action: Skip
* WAF components to skip
  * All remaining custom rules
  * All rate limiting rules
  * All managed rules
  * All Super Bot Fight Mode Rules
```
(ip.src in { 88.99.145.111 88.99.145.112 195.201.197.31 136.243.130.174 144.76.236.242 136.243.130.52 116.202.131.150 116.202.233.15 116.202.193.3 168.119.2.157 49.12.124.233 88.99.146.248 139.180.140.55 104.248.114.9 192.81.221.63 45.63.10.187 45.76.137.73 45.76.183.23 159.223.99.132 198.211.127.63 45.76.126.238 159.223.105.100 161.35.121.79 208.68.38.165 147.182.131.77 174.138.35.170 149.28.228.237 45.77.106.232 140.82.15.60 108.61.142.158 45.77.220.240 67.205.160.142 137.184.156.126 157.245.142.130 159.223.127.73 198.211.127.43 198.211.123.140 82.196.0.67 188.166.158.7 46.101.79.124 192.248.168.22 78.141.225.57 95.179.214.63 104.238.190.161 95.179.208.185 95.179.220.182 66.135.5.151 45.32.7.254 149.28.227.238 8.9.37.67 149.28.231.28 142.132.211.19 142.132.211.18 142.132.211.17 159.223.166.150 167.172.146.73 143.198.184.39 161.35.123.156 147.182.139.65 198.211.125.219 185.14.187.177 192.81.222.35 209.97.131.196 209.97.135.165 104.238.170.64 78.141.244.3 217.69.0.229 45.63.115.86 108.61.123.152 45.32.144.195 140.82.12.121 45.77.99.218 45.63.11.48 149.28.45.216 209.222.10.118 147.182.130.252 149.28.62.18 207.246.127.103 157.245.137.38 207.246.120.94 157.245.128.151 45.77.148.172 142.93.11.155 144.202.2.38 104.248.238.131 45.77.148.172 141.95.192.2 176.9.40.54 176.9.106.100 176.9.21.94 104.236.42.153 104.248.120.110 107.191.46.211 116.202.132.228 128.199.247.208 134.122.108.28 134.122.117.135 134.209.125.7 134.209.186.62 134.209.217.222 136.244.100.58 142.93.192.146 142.93.250.203 143.110.167.147 143.110.169.222 144.202.0.171 149.28.224.205 149.28.34.152 157.230.60.91 157.230.90.105 159.89.236.13 161.35.125.81 161.35.173.199 161.35.95.45 162.243.108.216 167.99.10.105 173.199.118.125 176.9.7.110 178.128.254.37 178.62.154.235 178.62.251.118 185.92.221.16 188.166.60.55 188.166.93.235 192.241.199.106 192.241.199.164 192.241.201.228 192.248.146.126 192.248.151.119 198.199.93.55 199.247.11.114 199.247.12.214 199.247.13.106 207.246.90.100 208.167.239.133 208.167.242.228 209.250.228.116 45.32.235.9 45.63.11.110 45.63.14.190 45.63.64.217 45.63.96.229 45.76.226.70 45.76.39.113 45.77.1.58 45.77.174.41 45.77.202.89 45.77.217.4 45.77.4.32 45.77.50.149 45.77.97.238 46.4.119.73 67.205.157.229 78.141.196.164 78.141.208.186 78.141.213.247 82.196.7.193 95.179.147.205 95.179.213.78 95.179.217.204 }) or (http.request.uri.query contains "bvVersion") or (http.request.uri.query contains "wc-api=wc_shipstation") or (http.user_agent contains "Zapier") or (http.user_agent contains "Metorik API Client") or (http.user_agent contains "Wordfence Central API") or (http.user_agent contains "Better Uptime Bot") or (http.user_agent contains "ShortPixel") or (http.user_agent contains "WPUmbrella") or (http.user_agent contains "Integrately") or (http.user_agent contains "Let's Encrypt") or (http.user_agent contains "Uptime-Kuma") or (cf.client.bot)"

```

R3V202 – Managed Challenge /wp-admin (Managed Challenge)​

* Action: Managed Challenge
```
(http.request.uri.path contains "/wp-login.php") or (http.request.uri.path contains "/wp-admin/" and http.request.uri.path ne "/wp-admin/admin-ajax.php" and not http.request.uri.path contains "/wp-admin/js/password-strength-meter.min.js")
```

R4V202 – Challenge Outside of GEO (JS Challenge)​

* Action: JS Challenge
```
(not ip.geoip.country in {"CA" "US"})
```

Rules v1​

Version v1.0, dated 2023-10-06 — the expression set before the v2 rewrite:

Rule 1 - Block URI Query, URL, User Agents, and IPs (Block)​

* Action: Block 
```
(http.request.uri.path eq "/xmlrpc.php")
```

Rule 2 - Allow URI Query, URL, User Agents, and IPs (Allow) BlogVault,WP Umbrella​

* Action: Allow
```
(ip.src in { 88.99.145.111 88.99.145.112 195.201.197.31 136.243.130.174 144.76.236.242 136.243.130.52 116.202.131.150 116.202.233.15 116.202.193.3 168.119.2.157 49.12.124.233 88.99.146.248 139.180.140.55 104.248.114.9 192.81.221.63 45.63.10.187 45.76.137.73 45.76.183.23 159.223.99.132 198.211.127.63 45.76.126.238 159.223.105.100 161.35.121.79 208.68.38.165 147.182.131.77 174.138.35.170 149.28.228.237 45.77.106.232 140.82.15.60 108.61.142.158 45.77.220.240 67.205.160.142 137.184.156.126 157.245.142.130 159.223.127.73 198.211.127.43 198.211.123.140 82.196.0.67 188.166.158.7 46.101.79.124 192.248.168.22 78.141.225.57 95.179.214.63 104.238.190.161 95.179.208.185 95.179.220.182 66.135.5.151 45.32.7.254 149.28.227.238 8.9.37.67 149.28.231.28 142.132.211.19 142.132.211.18 142.132.211.17 159.223.166.150 167.172.146.73 143.198.184.39 161.35.123.156 147.182.139.65 198.211.125.219 185.14.187.177 192.81.222.35 209.97.131.196 209.97.135.165 104.238.170.64 78.141.244.3 217.69.0.229 45.63.115.86 108.61.123.152 45.32.144.195 140.82.12.121 45.77.99.218 45.63.11.48 149.28.45.216 209.222.10.118 147.182.130.252 149.28.62.18 207.246.127.103 157.245.137.38 207.246.120.94 157.245.128.151 45.77.148.172 142.93.11.155 144.202.2.38 104.248.238.131 45.77.148.172 }) or (ip.src in {141.95.192.2}) or (http.request.uri.query contains "bvVersion") or (ip.src in {176.9.40.54 176.9.106.100 176.9.21.94}) or (http.user_agent contains "Zapier")
```

Rule 3 – Managed Challenge /wp-admin (Managed Challenge)​

* Action: Managed Challengex
```
(http.request.uri.path contains "/wp-login.php") or (http.request.uri.path contains "/wp-admin/" and http.request.uri.path ne "/wp-admin/admin-ajax.php")
```

Rule 4 – Allow Good Bots and User Agent/URI/URL Query (Allow)​

* Action: Allow
```
(cf.client.bot) or (http.user_agent contains "Metorik API Client") or (http.user_agent contains "Wordfence Central API") or (http.request.uri.query contains "wc-api=wc_shipstation") or (http.user_agent eq "Better Uptime Bot") or (http.user_agent eq "ShortPixel") or (http.user_agent contains "umbrella bot") or (http.user_agent contains "Integrately")
```

Rule 5 – Challenge Outside of GEO (JS Challenge)​

* Action: JS Challenge
```
(not ip.geoip.country in {"CA" "US"})
```