CLOUDFLARE WAF
Cloudflare WAF Rules, Switched On From xCloud
Cloudflare WAF is Cloudflare's web application firewall: it filters bad requests at its edge, before they reach your server. xCloud turns on five ready-made WAF rules for your site with a switch, and adds Under Attack mode. It works for sites using xCloud's Cloudflare integration, free on every plan.
- Five WAF rules, no rule syntax to learn
- Under Attack mode in one click
- Rules saved per site in your Cloudflare zone
WHY IT MATTERS
Why Block Attacks at Cloudflare's Edge?
A request blocked at Cloudflare never uses your server's CPU, PHP or database.
Less load on your server
Bots probing XML-RPC or old backups are stopped before they reach PHP.
Secrets stay hidden
Requests for .env files, logs, backups and .git folders are refused at the edge.
No rule writing
Cloudflare custom rules need an expression for each rule. xCloud writes them for you.
WHAT YOU GET
Which Cloudflare WAF Rules Can xCloud Turn On?
Find them in the Cloudflare Security Settings card, under Rules applied at Cloudflare's edge.
Allow good bots
Lets search engines and Let's Encrypt checks through while other bots are blocked.
Block sensitive files
Blocks .env files, backups, logs, .git and other configuration files.
Block wp-config.php
Protects the file that holds your database password. WordPress sites only.
Block XML-RPC
Stops XML-RPC password guessing and floods. WordPress sites only.
Block author scans
Stops attackers finding WordPress usernames from author pages and the REST API.
Under Attack mode
Cloudflare checks every visitor with a challenge page while your site is being flooded.
HOW IT WORKS
How Do You Turn On Cloudflare WAF Rules in xCloud?
Connect Cloudflare once, then each site gets its own rules.
Connect Cloudflare
Add a Cloudflare API token under Integrations, with Zone WAF Edit and Zone Read permissions.
Open Security
Open the site and go to Security, then Overview & Firewall.
Pick your rules
Turn on the rules you want in Cloudflare Security Settings.
Save
Click Save Settings. xCloud creates, updates or deletes the rules in your Cloudflare zone.
LIMITS AND PLANS
What Do You Need to Use It?
xCloud's Cloudflare integration
The site's domain needs a Cloudflare DNS record through the integration. A site you proxy by hand does not show the card.
Production sites only
Works on Nginx and OpenLiteSpeed. Staging sites never show the Cloudflare cards.
Three rules are WordPress only
wp-config.php, XML-RPC and author rules are hidden for Laravel, PHP and other site types.
Free on every plan
The WAF rules and Under Attack mode are free on every plan. Under Attack mode is not shown when the site uses Cloudflare Enterprise.
Frequently Asked Questions
What people ask about Cloudflare WAF on xCloud.
What is Cloudflare WAF?
Cloudflare WAF is a web application firewall that runs on Cloudflare's network. It inspects requests to your site with managed and custom rules and blocks bad ones before they reach your server.
How many Cloudflare WAF custom rules do I get?
Cloudflare sets the limit by its plan: 5 custom rules on Free, 20 on Pro, 100 on Business and 1,000 on Enterprise, per Cloudflare's custom rules docs, as of October 2026. The rules xCloud adds count toward that limit.
Do I need to write Cloudflare rule expressions?
No. Each option in Cloudflare Security Settings is a ready-made rule. Turn it on, click Save Settings, and xCloud writes the rule in your Cloudflare zone. Turn it off and save to delete it.
When should I use Under Attack mode?
Only while your site is being flooded. Cloudflare shows a challenge page to every visitor, including real ones, until you turn it off. In xCloud it is one switch on the Cloudflare Under Attack Mode card, with no Save button.
Why is the Cloudflare Security Settings card missing?
The card shows only for production sites whose domain has a Cloudflare DNS record through xCloud's Cloudflare integration, on Nginx or OpenLiteSpeed. Check the connection under the site's Domain menu.
Does Cloudflare WAF replace the 7G and 8G firewall?
No, they work together. Cloudflare rules stop requests at Cloudflare's edge. The 7G or 8G firewall runs on your own server and also protects traffic that does not go through Cloudflare.
Stop Attacks Before They Reach Your Server
Connect Cloudflare and switch on WAF rules for each site from one dashboard.