Cloudflare WAF: How to Secure Your Web Apps in 10 Minutes

Cloudflare’s WAF (Web Application Firewall) secures web applications by filtering and blocking malicious HTTP traffic before it reaches your server, reducing successful attacks by over 90% for most small-to-medium sites. By enabling managed rule sets, you can protect against SQL injection (hacking databases via input forms) and Cross-Site Scripting (XSS - injecting malicious scripts into pages) in less than 10 minutes. This cloud-based shield sits between your visitors and your hosting provider, acting as a security guard that checks every request for suspicious patterns.

Why is a WAF necessary for modern websites?

Every website on the public internet is constantly scanned by automated bots looking for weaknesses. These bots use advanced AI models like Claude Sonnet 4 or GPT-5 to generate sophisticated scripts that can bypass simple password protections. A WAF provides a layer of defense that stops these automated threats before they ever touch your actual code.

Without a WAF, your server must process every single request, even the malicious ones. This can lead to your server slowing down or crashing during a "DDoS attack" (Distributed Denial of Service - flooding a site with fake traffic to take it down). Using a WAF offloads this heavy lifting to Cloudflare’s global network, keeping your site fast and available.

Modern frameworks like Next.js 16 and React 20 have built-in security, but they aren't perfect. We've found that even the most secure codebases benefit from a WAF because it catches "Zero-Day vulnerabilities" (security flaws that were just discovered and haven't been patched yet). It acts as an insurance policy for your application's data.

What will you need to get started?

Before setting up the firewall, you need a few things ready to go. Don't worry if you haven't done this before; the process is designed to be user-friendly for beginners.

A Registered Domain: You must own a domain name (like yoursite.com) registered through a service like Namecheap or Cloudflare Registrar.
A Cloudflare Account: You can sign up for free, though some advanced WAF features require a Pro or Business plan.
Access to DNS Settings: You need the ability to change your domain's nameservers (the directory that tells the internet where your site is hosted) at your current registrar.
A Running Website: Your site should be active and hosted on a platform like Vercel, AWS, or a private VPS (Virtual Private Server).

How do you connect your site to Cloudflare?

The WAF only works if your traffic flows through Cloudflare first. This process is called "proxied traffic," and it starts by pointing your domain to Cloudflare’s servers.

Step 1: Add your site to the dashboard. Log into Cloudflare and click the "Add a Site" button. Enter your domain name and select a plan; the "Free" plan includes basic WAF protections, while "Pro" offers the more powerful Managed Rules.

Step 2: Update your Nameservers. Cloudflare will provide you with two specific nameservers (e.g., ashley.ns.cloudflare.com). Go to your domain registrar's website and replace your existing nameservers with these two new ones.

Step 3: Wait for propagation. It can take anywhere from a few minutes to a few hours for the internet to recognize this change. Once it's done, you'll see a "Great news! Cloudflare is now protecting your site" message.

Step 4: Check the Proxy status. In your DNS settings tab, look for the "Proxy status" column. Ensure the cloud icon is Orange (Proxied) rather than Grey (DNS only), otherwise the WAF cannot see or filter your traffic.

How do you enable managed rules for instant protection?

Managed Rules are pre-written security instructions created by experts to stop known hacking methods. Instead of writing your own code, you simply toggle these on to protect your application.

Step 1: Navigate to the Security tab. On your Cloudflare dashboard, click "Security" in the left-hand sidebar, then select "WAF." You will see three main sections: Custom Rules, Managed Rules, and Rate Limiting.

Step 2: Enable the Cloudflare Managed Ruleset. Click on "Managed Rules" and look for the "Cloudflare Managed Ruleset" toggle. Switch this to "On" to instantly block common attacks like SQL injection and "Broken Authentication" (stealing user sessions).

Step 3: Adjust the Sensitivity. You can set the "Sensitivity" level to Low, Medium, or High. For beginners, we recommend starting with "Medium" to avoid accidentally blocking legitimate visitors while still catching most threats.

Step 4: Deploy the OWASP Core Rule Set. OWASP (Open Web Application Security Project) is a global standard for security. Enabling this ruleset provides an extra layer of defense against the "Top 10" most dangerous web vulnerabilities.

How do you create custom rules for specific threats?

Sometimes you need to block traffic from a specific country or prevent people from accessing a sensitive folder like /admin. Custom rules allow you to set your own "If/Then" logic for your site.

Step 1: Create a new rule. In the WAF section, click "Custom Rules" and then "Create rule." Give your rule a clear name so you remember what it does later.

Step 2: Define the criteria. Use the dropdown menus to choose what to look for. For example, choose "Field: URI Path," "Operator: contains," and "Value: /wp-admin" to target your login page.

Step 3: Choose an action. Decide what happens when someone meets those criteria. You can "Block" them entirely, "Challenge" them with a Managed Challenge (a checkbox to prove they are human), or "Log" the event to see what they are doing without stopping them.

Step 4: Save and Deploy. Click "Deploy" to make the rule active immediately. You should see the rule appear in your list with a toggle to turn it off if it causes any issues for your users.

What are the common mistakes beginners make?

It is normal to feel a bit nervous about "breaking" your site when playing with firewall settings. Most issues come from being too aggressive with your rules or forgetting how the proxy works.

Blocking yourself: If you set a rule to block all traffic to /admin but don't exclude your own IP address (your computer's unique ID on the internet), you will lock yourself out. Always add an "Exclude" condition for your own IP.
Forgetting the "Orange Cloud": If your DNS record is set to "Grey Cloud," the WAF is completely bypassed. Traffic goes straight to your server, leaving you unprotected.
Ignoring the logs: If a user complains they can't access your site, check the "Security Events" log. It will show you exactly which rule blocked them so you can adjust it.
SSL Mismatches: If your site already has an SSL certificate (the lock icon in the browser), ensure your Cloudflare SSL setting is set to "Full" or "Full (Strict)." Setting it to "Flexible" can sometimes cause "Redirect Loops" where the site never loads.

Next Steps

Now that your WAF is active, you should monitor your "Security Events" for a few days to see what kind of traffic is being blocked. You might be surprised at how many bots are already trying to find holes in your site. As you get more comfortable, you can explore "Rate Limiting" to prevent people from clicking a button too many times or "Bot Management" to filter out AI crawlers that you don't want scraping your content.

official Cloudflare WAF documentation