WordPress.org
Get WordPress

Plugin Directory

Changeset 3451154


Ignore:
Timestamp:
01/31/2026 08:35:24 PM (3 weeks ago)
Author:
5starplugins
Message:

Update readme

Location:
waf-security-suite-for-cloudflare
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • waf-security-suite-for-cloudflare/tags/1.0/readme.txt

    r3450856 r3451154  
    22Contributors: 5starplugins
    33Tags: cloudflare, waf rules, security, firewall, bot protection
     4Requires at least: 6.0
    45Tested up to: 6.9
     6Requires PHP: 7.4
    57Stable tag: 1.0
    68License: GPLv3 or later
     9License URI: https://www.gnu.org/licenses/gpl-3.0.html
    710
    8 A plugin to bulk create and manage WAF rules within Cloudflare across multiple accounts.
     11Bulk deploy powerful WAF security rules to all your Cloudflare domains with one click. Protect your sites from bots, malicious traffic, and threats.
    912
    1013== Description ==
    1114
    12 #### A plugin to bulk create and manage WAF rules within Cloudflare across multiple accounts, using your Cloudflare API key.
     15**Supercharge your website security in minutes!** WAF Security Suite for Cloudflare lets you deploy enterprise-grade Web Application Firewall rules across all your domains instantly—no technical expertise required.
    1316
    14 ### Summary
    15 This plugin can be installed on any WordPress site you own, and then use it to bulk create the rules to as many domains in your Cloudflare account, including delegated member accounts you have access to.
     17### 🛡️ Why WAF Security Suite?
    1618
    17 It takes your Cloudflare API key, email, and account ID, and then gets all the domains in that account, and displays a checkbox list of them all, and you can choose the domains you want to add Troy’s WAF rules to, and bulk update all the domains with one click. Please see the notes and security tips in the plugin settings page.
     19Managing security rules across multiple Cloudflare domains is tedious and time-consuming. This plugin streamlines the process, allowing you to:
    1820
    19 ### Some Important Notes
    20 ⚠️ **Please note that this plugin overwites the 5 WAF rules on all domains, it will erase the existing rules and create new ones.** These 5 rules should work with Cloudflare Free, Pro and Business plans. They do not work for Enterprise Cloudflare, which most likely your web hosting provider controls directly.
     21* **Deploy in One Click** - Apply comprehensive WAF rules to multiple domains simultaneously
     22* **Save Time** - No more manually configuring rules on each domain
     23* **Enterprise Security** - Protect against bots, aggressive crawlers, malicious IPs, and common threats
     24* **Bank-Level Encryption** - Your API credentials are secured with AES-256-CBC encryption
     25* **Multi-Account Support** - Manage domains across different Cloudflare accounts (Premium)
    2126
    22 ⚠️ **Use at your own risk.** These rules may block certain services such as monitoring, uptime, or CDN services, so you may need to add exclusions if those services suddenly can't connect to your domain(s), using the Events log in Cloudflare showing the user agent or other data to add to the first rule that allows requests to bypass the remaining rules.
     27### 🚀 How It Works
    2328
    24 ### Configure Settings
    25 On the plugin's option page: First, add you credentials to the Cloudflare WAF Rules Wizard settings page in the plugin. Your email is the email you log in with. You can retrieve your [API key here](https://dash.cloudflare.com/profile/api-tokens). And [here are instructions](https://developers.cloudflare.com/fundamentals/setup/find-account-and-zone-ids/)  for where you can find your Account ID.
     291. **Connect Your Cloudflare Account** - Securely enter your API credentials (encrypted and stored safely)
     302. **Select Your Domains** - View all domains in your account with convenient checkboxes
     313. **Deploy Rules** - Click once to apply proven security rules across all selected domains
     324. **Stay Protected** - Your sites are now shielded from common threats and malicious traffic
    2633
    27 This will pull in the domains from the Account ID you entered. Select which domains you'd like to apply the WAF rules to.
     34### 🔥 What Gets Protected
    2835
    29 Last, check your Cloudflare WAF Rules to see if they have applied.
     36The plugin deploys **5 powerful security rules** that work together to protect your sites:
    3037
    31 ### Delete Settings and Deactivate/Delete
    32 After you are done adding your shiny new WAF Rules: ⚠️ **don't forget to click the Delete Settings button** after you are done using this plugin to remove your credentials from the database, for best security practices. They are not encrypted when stored. Maybe future versions will encrypt, delete the options on deactivation, etc. Right now it is a quick and simple plugin for you to use, delete the settings, and then deactivate and delete the plugin. It is not recommended to keep the plugin settings long term, or to keep the plugin active. You can always repeat the above steps later for adding additional domains or deleting and recreating the rules for existing domains.
     38* **Good Bot Allowlist** - Ensures legitimate bots (Google, Bing, monitoring tools) can access your site
     39* **Managed Challenges for Suspicious Traffic** - Automatically challenges requests from certain ASNs and non-US traffic
     40* **Aggressive Crawler Protection** - Blocks unauthorized crawlers and bots (Yandex, Semrush, Ahrefs, etc.)
     41* **VPN & Login Protection** - Adds extra challenges for VPN traffic and WordPress login attempts
     42* **Block Known Threats** - Automatically blocks web hosts, malicious IPs, TOR nodes, and attack vectors
     43
     44### ✨ Premium Features
     45
     46Upgrade to unlock advanced customization and enterprise management:
     47
     48* **🌐 Multi-Account Management** - Automatically manage domains across ALL your Cloudflare accounts
     49* **✅ Smart Bot Whitelisting** - Built-in checkboxes for 50+ trusted services across 8 categories
     50* **🔧 Custom User Agents** - Add your own user agent strings to the allowlist
     51* **🌍 Custom IP Whitelisting** - Bypass rules for specific trusted IP addresses
     52* **💬 Priority Support** - Get expert help when you need it
     53* **🎯 Advanced Customization** - Fine-tune rules to match your exact requirements
     54
     55**[Try Premium Free for 14 Days →](https://5starplugins.com/coming-soon-cloudflare-waf-rules-wizard/)** *(No credit card required)*
     56
     57### 📋 Important Information
     58
     59⚠️ **Rule Replacement:** This plugin replaces existing custom WAF rules on targeted domains. Make sure to back up any custom rules you want to keep.
     60
     61✅ **Compatibility:** Works with Cloudflare Free, Pro, and Business plans. Not compatible with Enterprise plans managed by hosting providers.
     62
     63⚠️ **Service Monitoring:** These rules might challenge some monitoring or uptime services. Check Cloudflare's Events log if services stop connecting, and add exceptions as needed.
     64
     65### 🔐 Security & Privacy
     66
     67Your security is our priority:
     68
     69* All API credentials are encrypted using military-grade AES-256-CBC encryption
     70* Credentials are securely stored in your WordPress database
     71* Delete settings with one click when not in use
     72* No data is sent to third-party servers (except Cloudflare's API)
     73
     74== Installation ==
     75
     76### Automatic Installation
     77
     781. Log in to your WordPress admin panel
     792. Navigate to **Plugins** → **Add New**
     803. Search for "WAF Security Suite for Cloudflare"
     814. Click **Install Now** and then **Activate**
     82
     83### Manual Installation
     84
     851. Download the plugin ZIP file
     862. Log in to your WordPress admin panel
     873. Navigate to **Plugins** → **Add New** → **Upload Plugin**
     884. Choose the ZIP file and click **Install Now**
     895. Click **Activate Plugin**
     90
     91### Getting Started
     92
     931. After activation, navigate to **WAF Security** in your WordPress admin menu
     942. Enter your Cloudflare credentials:
     95   * **API Key** - [Get yours here](https://dash.cloudflare.com/profile/api-tokens)
     96   * **API Email** - The email address for your Cloudflare account
     97   * **Account ID** (Free version only) - [Find it here](https://developers.cloudflare.com/fundamentals/setup/find-account-and-zone-ids/)
     983. Click **Save Settings** to retrieve your domains
     994. Select the domains you want to protect
     1005. Click **Create/Overwrite All WAF Rules**
     1016. Verify and edit further as needed the rules in your Cloudflare dashboard!
     102
     103That's it! Your sites are now protected.
     104
     105== Frequently Asked Questions ==
     106
     107= Will this affect my existing Cloudflare rules? =
     108
     109Yes, this plugin **replaces** the 5 custom WAF rules in your Cloudflare configuration. Any existing custom rules will be overwritten. The plugin does not affect Cloudflare's managed rulesets or other settings—only custom WAF rules.
     110
     111= Is my API key safe? =
     112
     113Absolutely. Your API credentials are encrypted using AES-256-CBC encryption (the same level used by banks) before being stored in your WordPress database. For additional security, you can delete your credentials from the database using the "Delete Settings" button when you're not actively managing rules.
     114
     115= What's the difference between Free and Premium? =
     116
     117The **Free version** lets you manage domains from a single Cloudflare account by entering your Account ID. The **Premium version** automatically retrieves domains from ALL Cloudflare accounts you have access to, plus adds powerful customization options including built-in bot whitelisting, custom user agents, and custom IP addresses. Premium also includes priority support.
     118
     119= Can I use this with Cloudflare Enterprise? =
     120
     121This plugin is designed for Cloudflare Free, Pro, and Business plans. Enterprise plans typically have different WAF rule management and may be controlled by your hosting provider, so this plugin may not be compatible.
     122
     123= Will this block legitimate bots like Google? =
     124
     125No. The first rule explicitly allows verified bots from major search engines (Google, Bing), monitoring services, and other legitimate services. The Premium version offers even more control with 50+ built-in trusted services you can whitelist.
     126
     127= What happens if a monitoring service gets blocked? =
     128
     129If you notice a service can't connect after applying rules, check Cloudflare's Events log to see what was blocked. You can then add that service's user agent or IP to the allowlist. Premium users can do this directly in the plugin with custom user agents and IP fields.
     130
     131== Screenshots ==
     132
     1331. Main settings page with domain selection
     1342. API credentials configuration (securely encrypted)
     1353. Premium Good Bot customization options
     1364. Successfully deployed rules confirmation
     1375. Cloudflare dashboard showing applied WAF rules
     138
     139== Changelog ==
     140
     141= 1.0.0 - 2026-01-31 =
     142* 🎉 Initial release
     143* ✅ Bulk WAF rule deployment across multiple domains
     144* 🔐 AES-256-CBC encryption for API credentials
     145* 🌟 5 pre-configured security rules
     146* 🚀 Premium version with multi-account support
     147* ✨ Premium: 50+ built-in trusted bot checkboxes
     148* 🎯 Premium: Custom user agent whitelisting
     149* 🌍 Premium: Custom IP address whitelisting
     150* 💬 Premium: Priority support
     151* 📱 Responsive admin interface
     152* 🎨 Modern UI with dark header design
     153
     154== Upgrade Notice ==
     155
     156= 1.0.0 =
     157Initial release of WAF Security Suite for Cloudflare. Deploy comprehensive security rules to all your Cloudflare domains with one click!

  • waf-security-suite-for-cloudflare/trunk/readme.txt

    r3449240 r3451154  
    22Contributors: 5starplugins
    33Tags: cloudflare, waf rules, security, firewall, bot protection
     4Requires at least: 6.0
    45Tested up to: 6.9
     6Requires PHP: 7.4
    57Stable tag: 1.0
    68License: GPLv3 or later
     9License URI: https://www.gnu.org/licenses/gpl-3.0.html
    710
    8 A plugin to bulk create and manage WAF rules within Cloudflare across multiple accounts.
     11Bulk deploy powerful WAF security rules to all your Cloudflare domains with one click. Protect your sites from bots, malicious traffic, and threats.
    912
    1013== Description ==
    1114
    12 #### A plugin to bulk create and manage WAF rules within Cloudflare across multiple accounts, using your Cloudflare API key.
     15**Supercharge your website security in minutes!** WAF Security Suite for Cloudflare lets you deploy enterprise-grade Web Application Firewall rules across all your domains instantly—no technical expertise required.
    1316
    14 ### Summary
    15 This plugin can be installed on any WordPress site you own, and then use it to bulk create the rules to as many domains in your Cloudflare account, including delegated member accounts you have access to.
     17### 🛡️ Why WAF Security Suite?
    1618
    17 It takes your Cloudflare API key, email, and account ID, and then gets all the domains in that account, and displays a checkbox list of them all, and you can choose the domains you want to add Troy’s WAF rules to, and bulk update all the domains with one click. Please see the notes and security tips in the plugin settings page.
     19Managing security rules across multiple Cloudflare domains is tedious and time-consuming. This plugin streamlines the process, allowing you to:
    1820
    19 ### Some Important Notes
    20 ⚠️ **Please note that this plugin overwites the 5 WAF rules on all domains, it will erase the existing rules and create new ones.** These 5 rules should work with Cloudflare Free, Pro and Business plans. They do not work for Enterprise Cloudflare, which most likely your web hosting provider controls directly.
     21* **Deploy in One Click** - Apply comprehensive WAF rules to multiple domains simultaneously
     22* **Save Time** - No more manually configuring rules on each domain
     23* **Enterprise Security** - Protect against bots, aggressive crawlers, malicious IPs, and common threats
     24* **Bank-Level Encryption** - Your API credentials are secured with AES-256-CBC encryption
     25* **Multi-Account Support** - Manage domains across different Cloudflare accounts (Premium)
    2126
    22 ⚠️ **Use at your own risk.** These rules may block certain services such as monitoring, uptime, or CDN services, so you may need to add exclusions if those services suddenly can't connect to your domain(s), using the Events log in Cloudflare showing the user agent or other data to add to the first rule that allows requests to bypass the remaining rules.
     27### 🚀 How It Works
    2328
    24 ### Configure Settings
    25 On the plugin's option page: First, add you credentials to the Cloudflare WAF Rules Wizard settings page in the plugin. Your email is the email you log in with. You can retrieve your [API key here](https://dash.cloudflare.com/profile/api-tokens). And [here are instructions](https://developers.cloudflare.com/fundamentals/setup/find-account-and-zone-ids/)  for where you can find your Account ID.
     291. **Connect Your Cloudflare Account** - Securely enter your API credentials (encrypted and stored safely)
     302. **Select Your Domains** - View all domains in your account with convenient checkboxes
     313. **Deploy Rules** - Click once to apply proven security rules across all selected domains
     324. **Stay Protected** - Your sites are now shielded from common threats and malicious traffic
    2633
    27 This will pull in the domains from the Account ID you entered. Select which domains you'd like to apply the WAF rules to.
     34### 🔥 What Gets Protected
    2835
    29 Last, check your Cloudflare WAF Rules to see if they have applied.
     36The plugin deploys **5 powerful security rules** that work together to protect your sites:
    3037
    31 ### Delete Settings and Deactivate/Delete
    32 After you are done adding your shiny new WAF Rules: ⚠️ **don't forget to click the Delete Settings button** after you are done using this plugin to remove your credentials from the database, for best security practices. They are not encrypted when stored. Maybe future versions will encrypt, delete the options on deactivation, etc. Right now it is a quick and simple plugin for you to use, delete the settings, and then deactivate and delete the plugin. It is not recommended to keep the plugin settings long term, or to keep the plugin active. You can always repeat the above steps later for adding additional domains or deleting and recreating the rules for existing domains.
     38* **Good Bot Allowlist** - Ensures legitimate bots (Google, Bing, monitoring tools) can access your site
     39* **Managed Challenges for Suspicious Traffic** - Automatically challenges requests from certain ASNs and non-US traffic
     40* **Aggressive Crawler Protection** - Blocks unauthorized crawlers and bots (Yandex, Semrush, Ahrefs, etc.)
     41* **VPN & Login Protection** - Adds extra challenges for VPN traffic and WordPress login attempts
     42* **Block Known Threats** - Automatically blocks web hosts, malicious IPs, TOR nodes, and attack vectors
     43
     44### ✨ Premium Features
     45
     46Upgrade to unlock advanced customization and enterprise management:
     47
     48* **🌐 Multi-Account Management** - Automatically manage domains across ALL your Cloudflare accounts
     49* **✅ Smart Bot Whitelisting** - Built-in checkboxes for 50+ trusted services across 8 categories
     50* **🔧 Custom User Agents** - Add your own user agent strings to the allowlist
     51* **🌍 Custom IP Whitelisting** - Bypass rules for specific trusted IP addresses
     52* **💬 Priority Support** - Get expert help when you need it
     53* **🎯 Advanced Customization** - Fine-tune rules to match your exact requirements
     54
     55**[Try Premium Free for 14 Days →](https://5starplugins.com/coming-soon-cloudflare-waf-rules-wizard/)** *(No credit card required)*
     56
     57### 📋 Important Information
     58
     59⚠️ **Rule Replacement:** This plugin replaces existing custom WAF rules on targeted domains. Make sure to back up any custom rules you want to keep.
     60
     61✅ **Compatibility:** Works with Cloudflare Free, Pro, and Business plans. Not compatible with Enterprise plans managed by hosting providers.
     62
     63⚠️ **Service Monitoring:** These rules might challenge some monitoring or uptime services. Check Cloudflare's Events log if services stop connecting, and add exceptions as needed.
     64
     65### 🔐 Security & Privacy
     66
     67Your security is our priority:
     68
     69* All API credentials are encrypted using military-grade AES-256-CBC encryption
     70* Credentials are securely stored in your WordPress database
     71* Delete settings with one click when not in use
     72* No data is sent to third-party servers (except Cloudflare's API)
     73
     74== Installation ==
     75
     76### Automatic Installation
     77
     781. Log in to your WordPress admin panel
     792. Navigate to **Plugins** → **Add New**
     803. Search for "WAF Security Suite for Cloudflare"
     814. Click **Install Now** and then **Activate**
     82
     83### Manual Installation
     84
     851. Download the plugin ZIP file
     862. Log in to your WordPress admin panel
     873. Navigate to **Plugins** → **Add New** → **Upload Plugin**
     884. Choose the ZIP file and click **Install Now**
     895. Click **Activate Plugin**
     90
     91### Getting Started
     92
     931. After activation, navigate to **WAF Security** in your WordPress admin menu
     942. Enter your Cloudflare credentials:
     95   * **API Key** - [Get yours here](https://dash.cloudflare.com/profile/api-tokens)
     96   * **API Email** - The email address for your Cloudflare account
     97   * **Account ID** (Free version only) - [Find it here](https://developers.cloudflare.com/fundamentals/setup/find-account-and-zone-ids/)
     983. Click **Save Settings** to retrieve your domains
     994. Select the domains you want to protect
     1005. Click **Create/Overwrite All WAF Rules**
     1016. Verify and edit further as needed the rules in your Cloudflare dashboard!
     102
     103That's it! Your sites are now protected.
     104
     105== Frequently Asked Questions ==
     106
     107= Will this affect my existing Cloudflare rules? =
     108
     109Yes, this plugin **replaces** the 5 custom WAF rules in your Cloudflare configuration. Any existing custom rules will be overwritten. The plugin does not affect Cloudflare's managed rulesets or other settings—only custom WAF rules.
     110
     111= Is my API key safe? =
     112
     113Absolutely. Your API credentials are encrypted using AES-256-CBC encryption (the same level used by banks) before being stored in your WordPress database. For additional security, you can delete your credentials from the database using the "Delete Settings" button when you're not actively managing rules.
     114
     115= What's the difference between Free and Premium? =
     116
     117The **Free version** lets you manage domains from a single Cloudflare account by entering your Account ID. The **Premium version** automatically retrieves domains from ALL Cloudflare accounts you have access to, plus adds powerful customization options including built-in bot whitelisting, custom user agents, and custom IP addresses. Premium also includes priority support.
     118
     119= Can I use this with Cloudflare Enterprise? =
     120
     121This plugin is designed for Cloudflare Free, Pro, and Business plans. Enterprise plans typically have different WAF rule management and may be controlled by your hosting provider, so this plugin may not be compatible.
     122
     123= Will this block legitimate bots like Google? =
     124
     125No. The first rule explicitly allows verified bots from major search engines (Google, Bing), monitoring services, and other legitimate services. The Premium version offers even more control with 50+ built-in trusted services you can whitelist.
     126
     127= What happens if a monitoring service gets blocked? =
     128
     129If you notice a service can't connect after applying rules, check Cloudflare's Events log to see what was blocked. You can then add that service's user agent or IP to the allowlist. Premium users can do this directly in the plugin with custom user agents and IP fields.
     130
     131== Screenshots ==
     132
     1331. Main settings page with domain selection
     1342. API credentials configuration (securely encrypted)
     1353. Premium Good Bot customization options
     1364. Successfully deployed rules confirmation
     1375. Cloudflare dashboard showing applied WAF rules
     138
     139== Changelog ==
     140
     141= 1.0.0 - 2026-01-31 =
     142* 🎉 Initial release
     143* ✅ Bulk WAF rule deployment across multiple domains
     144* 🔐 AES-256-CBC encryption for API credentials
     145* 🌟 5 pre-configured security rules
     146* 🚀 Premium version with multi-account support
     147* ✨ Premium: 50+ built-in trusted bot checkboxes
     148* 🎯 Premium: Custom user agent whitelisting
     149* 🌍 Premium: Custom IP address whitelisting
     150* 💬 Premium: Priority support
     151* 📱 Responsive admin interface
     152* 🎨 Modern UI with dark header design
     153
     154== Upgrade Notice ==
     155
     156= 1.0.0 =
     157Initial release of WAF Security Suite for Cloudflare. Deploy comprehensive security rules to all your Cloudflare domains with one click!
Note: See TracChangeset for help on using the changeset viewer.