Even with a free plan, Cloudflare proxy allows you to filter some bot traffic, especially if you enable Bot Fight mode and other security and vulnerability blocking features. Cloudflare proxy also allows you to hide the real IP address of your web server.
Enabling Cloudflare proxy is very simple. Just register and transfer your domain’s DNS records to Cloudflare’s DNS servers. At the time of writing, I had migrated several sites from Godaddy and Hetzner to Cloudflare and enabled proxying for them. The domain registrar doesn’t change; you just need to point your domain registrar’s DNS servers to Cloudflare in the settings and duplicate all DNS records there (after the migration, some domain registrars may delete them because they’re no longer in use). Before transferring, I exported a backup copy of the records to text files. You can restore everything to its original state if needed. I deleted the Godaddy and Hetzner NS records in Cloudflare.
Note that blocking traffic via iptables will be impossible, since after enabling the proxy, requests will physically come from Cloudflare proxy servers. However, the users’ real IP will be specified in the CF-Connecting-IP header, which must be configured in the web server configuration. Then, the user’s IP will be displayed in requests and logs as before. After this, you can block requests through the web server configuration or, better yet, through the Cloudflare panel – Security – Security rules, and add a “Block” rule listing the Source IP to prevent requests from reaching the web server.
Some sites have been attacked, and Cloudflare has a great feature called “Under Attack Mode.” Its only downside is that it’s enabled globally for a domain and all subdomains. However, I’ll show you how to enable it manually, for example, for a single subdomain. To do this, create Security rules in the Cloudflare panel. This will result in a JS page being displayed and a browser check (instead of a JS Challenge, you can use a Managed Challenge, which is a bit weaker):
Expression: http.host eq "sub.ixnfo.com"
Action: JS Challenge
The following networks can be excluded from the scan:
(http.host eq "sub.ixnfo.com")
and not (ip.src in {10.0.0.0/8 172.16.0.0/12})
Another example of blocking spam bots on a subdomain from an IPv6 network:
Rule name: IPv6_Spam_Challenge
Expression: (ip.src in {::/0} and http.host eq "sub.ixnfo.com")
Action: Managed Challenge
On the free plan, if Bot Fight mode is enabled, Security rules do not apply to Bot Fight mode. For example, if you want to exclude your application’s API requests from Bot Fight mode blocks, you will need to disable Bot Fight mode or pay for a plan.
The free plan also has a file upload limit of 100 megabytes, which can be critical for cloud storage services, for example. There are no file size limits for downloads.
I’d also like to point out that if you use Let’s Encrypt certificates, their auto-renewal will stop working, as the IP address will no longer belong to the server, but to Cloudflare. This can be resolved by setting up auto-renewal via DNS records, which is unsafe, as Cloudflare’s API keys, which have permission to modify the domain’s DNS records, will be stored on the server. Cloudflare also offers its own 15-year certificate, but it only works for server communication with Cloudflare and is not suitable for displaying to users. This is an excellent solution if you don’t plan to disable Cloudflare proxy.
Cloudflare has had very rare outages, and you can check the status of any issues at cloudflarestatus.com.
Example of a Managed Challenge for the WordPress admin panel:
(http.request.uri.path contains "/wp-admin/" and not http.request.uri.path contains "/wp-admin/admin-ajax.php")
or (http.request.uri.path in {"/wp-login.php" "/xmlrpc.php" "/wp-signup.php" "/wp-register.php"})
or (http.request.uri.path contains "/wp-json/wp/v2/users")
or (http.request.uri.query contains "action=lostpassword")
Example of a Managed Challenge for a phpBB forum with search bot exclusion:
(http.request.uri.path contains "/viewtopic.php"
or http.request.uri.path contains "/download/file.php"
or http.request.uri.path contains "/search.php")
and not cf.client.bot
Example for the specified domain with the exclusion of search bots and country:
http.host eq "ixnfo.com" and not cf.client.bot and ip.geoip.country ne "US"
See also my article:
Configuring CF-Connecting-IP Header