Collect example requests and identify why they should be challenged or blocked. Confirm the fields, actions and rule allowance available on your Cloudflare plan, and preserve a way to disable the rule if it blocks administration.

1. Open the zone’s Security rules page and choose Create rule > Custom rules.
2. Give the rule a meaningful name and build an expression with the intended hostname and request conditions. Check how AND, OR and grouping affect its scope.
3. Choose an available action appropriate to the traffic. Browser challenges can break API clients, webhooks and automated monitors.
4. Review rule ordering and existing exceptions, then deploy during a period when you can observe the effect.
5. Test a matching request and representative legitimate requests, including login and integrations. Inspect Security Events for the actual rule and action.

After confirming repeated unwanted requests in Security Events, a rule can match a specific source and endpoint. The IP below is a documentation address. Replace it only with the verified source you intend to restrict and review legitimate users who may share that address.

http.host eq "example.com" and
http.request.uri.path eq "/wp-login.php" and
http.request.method eq "POST" and
ip.src eq 198.51.100.42

Choose the action that fits the observed traffic and available plan controls, then test during a period when you can review events. An address match is a network restriction, not proof of a person’s identity. Keep a route to disable or narrow the rule if legitimate login traffic is affected.

Expected result: The intended matching requests produce the expected rule event, while unrelated paths and hosts remain outside the condition. Authentication, strong credentials and application protections remain in place alongside the narrow edge rule.

The intended traffic should receive the chosen action and legitimate workflows should continue. Record the rule’s purpose, owner and reason for any exception.

If a false positive appears, narrow the expression or create a carefully scoped exception for the relevant control. Do not turn an entire hostname into a broad security bypass simply because one endpoint requires different treatment.

No. Network geography can be imprecise and user-agent text is client supplied. Use these as contextual signals, not as a replacement for application authentication.

• Investigating a Cloudflare WAF false positive with Ray IDs
• Reading Cloudflare security events for an incident
• Diagnosing overlapping Cloudflare rules
• Applying an available rate-limit rule to an abused login endpoint

• Cloudflare: Create Dashboard
• Cloudflare: Concepts

• Cloudflare WAF custom rules
• Cloudflare rule fields