Book a demo
Book a demo
Login

How to Enable Cloudflare WAF Rules for Site Security in xCloud?

Updated November 6, 2026 · 4 min read

Summarize with:
Share:

Keeping your WordPress site secure takes more than just strong passwords and regular updates. Many common attacks target areas like XML-RPC, sensitive files, wp-config.php, and author enumeration. If these are left unprotected, your site can become more vulnerable to unauthorized access, spam, and other security threats. For an overview of what it does and which plans include it, see the Cloudflare WAF feature page.

xCloud’s Cloudflare WAF integration lets you activate Web Application Firewall rules directly from your site’s security page, without opening the Cloudflare dashboard. When you toggle a security option in xCloud, the corresponding WAF rule is automatically created, updated, or deleted in your Cloudflare zone. Rules are stored per-site, so each site on your server can have its own security configuration.

What Is Cloudflare WAF?

Cloudflare’s Web Application Firewall (WAF) filters malicious HTTP traffic before it reaches your server. Custom rules let you block specific attack vectors – such as requests targeting sensitive config files, XML-RPC abuse, or author enumeration scans – at the CDN edge, before the request ever hits your origin. xCloud integrates with Cloudflare WAF via API, so you can manage these rules without leaving the xCloud dashboard.

Prerequisites

  • An active xCloud site on a production server
  • Cloudflare DNS integration enabled and active for the site (the security card will not appear for sites without active Cloudflare DNS records)
  • A Cloudflare API token in xCloud with the Zone › Zone WAF › Edit permission, and Zone › Zone › Read so xCloud can find the zone
  • For WordPress-specific options: the site must be running WordPress (these options are hidden for Laravel, custom PHP, and other app types)

That is why Cloudflare Security Settings in xCloud are so important. Instead of manually creating and managing Cloudflare rules, you can quickly enable essential protections directly from your xCloud dashboard. This makes it easier to strengthen your site’s security without going through a complicated setup process.

_
Note: This feature is available for both NGINX and OLS servers._

Step 1: Go to Your Site

First, open the site you want to configure. In the site menu, go to Security → Overview & Firewall. On Nginx servers the browser tab reads Nginx and Security, and on OpenLiteSpeed servers it reads Security.

When the site uses Cloudflare, the Cloudflare rules tile at the top of the page shows how many of the rules are on, for example 3 of 5 on.

Cloudflare rules tile showing 3 of 5 on at the top of Security → Overview & Firewall

Step 2: Turn on the Cloudflare rules you need

Scroll to the Cloudflare Security Settings card. Its Rules applied at Cloudflare’s edge group lists these options:

  • Allow Good Bots + ACME/Let’s Encrypt Validation: Lets search engines and SSL certificate checks through while other bots are blocked.
  • Block Sensitive File Access: Blocks .env files, backups, logs, .git and other configuration files.
  • Block Direct Access to wp-config.php: Protects the database credentials stored in wp-config.php. WordPress sites only.
  • Block XML-RPC: Stops XML-RPC brute-force and DDoS attempts before they reach your server. WordPress sites only.
  • Block Author Enumeration: Stops attackers finding WordPress usernames through author archives and the REST API. WordPress sites only.

Turn each option on or off. The bar at the bottom of the card changes from Saving updates these rules at Cloudflare. to You have unsaved changes., and Save Settings turns solid blue. Click Save Settings to apply the rules at Cloudflare, or Discard to undo your changes.

Cloudflare Security Settings card with the rule switches and the Save Settings button

Troubleshooting

  • The Cloudflare Security Settings card is not showing on the Security → Overview & Firewall page. → The card only appears when all of these are true:

    • The site is a production site.
    • Your team has connected Cloudflare to xCloud.
    • The site’s domain has a Cloudflare DNS record through that integration.
    • The site runs on Nginx or OpenLiteSpeed.

    Check the Cloudflare connection under the site’s Domain menu. A site you proxy through Cloudflare by hand, without xCloud’s integration, does not show the card, and staging sites never do.

  • WordPress-specific options (wp-config.php, XML-RPC, Author Enumeration) are not visible. → These options only appear for WordPress sites. If your site runs Laravel, custom PHP, or another stack, these options will not be shown.

  • Saving settings returns an error. → If the token lacks a permission, the error names it, for example Your Cloudflare API token is missing the “Zone › Zone WAF › Edit” permission…. Add that permission to the token in Cloudflare, or update the integration with a token that has it. You may also be hitting Cloudflare’s API rate limits. Wait a moment and try again.

  • A rule was enabled but does not appear in the Cloudflare WAF dashboard. → xCloud applies changes only to settings that differ from the current state. If a rule already exists in Cloudflare from a previous session, it may not be recreated. Check Cloudflare’s WAF Custom Rules list directly. If the rule is missing, turn the option off and click Save Settings, then turn it on again and save.

  • I disabled a rule but it still appears in Cloudflare. → Cloudflare may take a few seconds to propagate rule deletions. Refresh the Cloudflare WAF page after ~30 seconds. If the rule persists, check xCloud logs for API errors related to the delete operation.

And that’s it this is how easily you can configure Cloudflare security settings in xCloud. Cloudflare Security Settings in xCloud give you a simple way to add important protection to your WordPress site without manually configuring security rules in Cloudflare. With just a few clicks, you can block common attack vectors, protect sensitive files, and improve your site’s overall security posture.