Cloudflare Firewall Manager — Documentation

Your Cloudflare dashboard is powerful, but let's be honest — navigating rulesets across multiple domains can feel like a full-time job. The Cloudflare Firewall Manager puts you back in control with a single, streamlined dashboard where you can create, apply, and manage firewall rules across all your Cloudflare zones in minutes instead of hours.

Getting Started

Connecting Your Cloudflare API Token

Before you can do anything, you'll need to connect your Cloudflare account by adding an API token. Here's how:

1. Head over to the Cloudflare Dashboard → API Tokens.
2. Click Create Token.
3. Your token needs two permissions:
   • Zone → Zone → Read — so we can see your domains.
   • Zone → Zone WAF → Edit — so we can create and manage firewall rules.
4. Back on your dashboard, click the Add New Token button.
5. Give it a descriptive label (e.g., "Production Sites" or "Client Portfolio") and paste your token.
6. Hit Save Token.

Your first token is automatically set as the active one. That's it — you're connected.

Validating Your Token

Once saved, click the Validate button next to your active token. This sends a quick verification request to Cloudflare to confirm your token has the right permissions. You'll see either a green ✓ Validated badge or a warning if something needs adjusting.

Tip: If validation fails, double-check that your token has both Zone:Read and Zone WAF:Edit permissions in Cloudflare.

Managing API Tokens

Multiple Tokens

You're not limited to a single API token. Depending on your plan, you can store multiple tokens — perfect if you manage different Cloudflare accounts or want to separate production from staging environments.

Your current usage is always visible at the top of the API Tokens section as a simple counter (e.g., 2 / 5).

Switching Between Tokens

Only one token can be active at a time. The active token determines which Cloudflare zones and rules you see. To switch:

• Find the token you want to use in the token list.
• Click the Switch button next to it.

The dashboard refreshes to show the zones available under that token. Your previously cached zone data is automatically cleared so you always see up-to-date information.

Deleting a Token

Click Delete on any token you no longer need. If you delete your active token, the system automatically activates your next available token. If it's your only token, you'll be prompted to add a new one.

Note: All tokens are stored with AES-256 encryption. Your raw API keys are never visible — not even to site administrators.

Selecting Zones

Once you have a validated API token, the Select Zone dropdown automatically populates with all the domains (zones) available on your Cloudflare account.

• Select a zone from the dropdown to start managing its firewall rules.
• Click the Refresh button if you've recently added a new domain to Cloudflare and don't see it listed yet.

When you select a zone, the Active Rules on Zone section loads automatically, showing you every firewall rule currently deployed on that domain.

Single Mode vs. Bulk Mode

The dashboard offers two distinct workflows, accessible via the mode tabs at the top:

Single Mode

This is your default view. It's perfect for working with one zone at a time:

• Select a specific zone.
• View its active rules.
• Apply or delete individual rules.
• Choose exactly where each new rule should be positioned in the ruleset.

Bulk Mode

When you need to roll out rules across multiple domains at once, Bulk Mode is your best friend:

1. Select Zones — Check the domains you want to target. Use Select All / Deselect All for quick selection.
2. Select Rules — Check the preconfigured and/or custom rules you want to apply.
3. Order Your Rules — Drag and drop the selected rules into the order you want them applied. Rules are processed from top to bottom.
4. Choose Position — Decide whether to place your rules before or after the existing rules on each zone.
5. Hit "Apply to All Selected" — A progress bar shows you exactly what's happening: which zone is being processed, which rule is being applied, and whether each operation succeeded or failed.

Tip: Bulk Mode is especially useful during initial setup — select all your zones, pick the preconfigured rules you like, and deploy your entire security baseline in one click.

Preconfigured Rules

The dashboard comes with a library of battle-tested firewall rules that are ready to deploy. These cover the most common security scenarios:

Block Bad Bots & Suspicious Countries

Blocks known malicious user agents, spam referrers, traffic from high-risk countries (CN, RU, UA, SG, HK, VN, TOR), and suspicious ASNs. This is the big one — a comprehensive catchall that stops most junk traffic.

Block AI Crawlers

Blocks AI training crawlers: GPTBot, ChatGPT-User, CCBot, Anthropic, Claude-Web, Google-Extended, and Bytespider. If you don't want AI companies scraping your content, flip this on.

Challenge Suspicious Requests

Issues a managed challenge (invisible CAPTCHA) for requests that contain eval(), base64, <script>, UNION SELECT, or path traversal (../) in the query string. Catches most common injection attempts without blocking legitimate users.

Block WP Login Brute Force

Blocks direct access to /wp-login.php from TOR exit nodes and known bad hosting ASNs. Stops automated brute-force login attempts before they eat up your server resources.

Challenge XML-RPC Access

Puts a JavaScript challenge in front of /xmlrpc.php. Legitimate tools like the WordPress mobile app can pass it, but automated abuse scripts can't.

Block Bad Referrers

Blocks traffic from known spam referrer domains (.xyz, semalt.com, buttons-for-website.com, darodar.com). Keeps your analytics clean.

Allow Known Good Bots

Explicitly allows verified bots from Google, Bing, and monitoring services. Use this above your blocking rules to make sure legitimate search engine crawlers are never accidentally blocked.

Challenge Empty User Agent

Issues a managed challenge for requests with a completely empty user agent string. Real browsers always send a user agent — empty ones are almost always bots.

Important: Each preconfigured rule shows its Cloudflare action (Block, Managed Challenge, JS Challenge, or Skip). You can click the View button to inspect the full expression before applying it.

Custom Rules

Preconfigured rules cover the basics, but sometimes you need something tailored. The Custom Rules section lets you create your own firewall rules from scratch.

Creating a Custom Rule

1. Fill in the Rule Name — something descriptive like "Block Country X" or "Rate limit API endpoint."
2. Add a Description (optional) — helps you remember why you created this rule six months from now.
3. Choose an Action:
   • Block — Flat out deny the request.
   • Challenge (CAPTCHA) — Show a CAPTCHA challenge.
   • JS Challenge — Show a JavaScript challenge (less intrusive than CAPTCHA).
   • Managed Challenge — Cloudflare decides the best challenge type automatically.
   • Allow/Skip — Explicitly allow matching traffic (useful for whitelisting).
   • Log — Log the request without taking any action (great for testing).
4. Write your Expression using Cloudflare's expression language. For example:
   • (ip.geoip.country eq "DE") — Matches all traffic from Germany.
   • (http.request.uri.path contains "/api/") — Matches requests to your API endpoints.
   • (ip.src in {1.2.3.4 5.6.7.8}) — Matches specific IP addresses.
5. Click Save Rule.

Your rule is saved to your rule library. It's not deployed to Cloudflare yet — you choose when and where to apply it.

Editing and Deleting Custom Rules

• Click Edit on any custom rule to modify its name, description, action, or expression.
• Click Delete to remove it from your library entirely.

Applying a Custom Rule

Once saved, click the Apply button on any custom rule. A position modal appears, giving you precise control over where the rule sits in your zone's ruleset:

• Default (end of list) — Appends the rule at the bottom.
• First (top of list) — Places it at the very top, so it's evaluated first.
• Last (bottom of list) — Equivalent to default.
• Before a specific rule — Select an existing rule to place yours directly above it.
• After a specific rule — Select an existing rule to place yours directly below it.
• At specific position — Enter a number (e.g., 3) to place it at that exact position.

The modal also shows you the list of rules currently on the zone, so you can see exactly where your new rule will land.

Viewing & Deleting Active Rules

When you select a zone, the Active Rules on Zone section shows every firewall rule currently deployed. For each rule, you'll see:

• The rule name/description.
• Its action (block, challenge, etc.).
• A Delete button to remove it directly from Cloudflare.

Caution: Deleting a rule here removes it from your Cloudflare zone immediately. This action cannot be undone. If you need the rule again, you'll have to re-apply it.

Activity Log

Every time you apply or delete a rule, the action is recorded in your Activity Log. Click Load Activity Log to see your history, including:

• Zone name — Which domain was affected.
• Rule name — Which rule was applied or deleted.
• Rule type — Whether it was preconfigured or custom.
• Status — Success or failure.
• Message — Details about what happened (including error messages if something went wrong).
• Timestamp — When it happened.

Activity logs are kept for 90 days before being automatically cleaned up.

Troubleshooting

"Token validation failed"

• Verify your token has Zone:Read and Zone WAF:Edit permissions in the Cloudflare dashboard.
• Make sure the token hasn't expired or been revoked.
• If you recently created the token, wait a minute and try again — Cloudflare sometimes has a brief propagation delay.

"No zones found" after connecting a token

• Your token might be scoped to specific zones. Check the token's Zone Resources setting in Cloudflare — make sure it includes the zones you expect.
• Click Refresh to force a fresh lookup.

A rule failed to apply

• Check the Activity Log for the specific error message from Cloudflare.
• The most common cause is an invalid expression. Cloudflare's expression syntax is strict — a missing parenthesis or typo will cause the API to reject it.
• Some Cloudflare plans have limits on the number of custom firewall rules. If you've hit the limit, you'll need to delete an existing rule first.

"Token limit reached"

• Your plan has a maximum number of API tokens. Check the tier table above to see your limit.
• Delete tokens you're no longer using to free up slots.

Rules aren't taking effect

• Cloudflare rules can take up to a minute to propagate.
• Verify the rule is actually on the zone by selecting it in the zone dropdown and checking the "Active Rules on Zone" list.
• Make sure the rule's expression matches the traffic you expect. Use the Log action first to test without blocking real visitors.

Bulk Mode shows failures on some zones

• Each zone is processed independently. A failure on one zone doesn't affect the others.
• Check the progress log for specific error messages. Common causes: the zone has hit its rule limit, or the token doesn't have permissions for that specific zone.

FAQ

How many Cloudflare rules can I have per zone?

This depends on your Cloudflare plan, not this tool. Free Cloudflare plans allow 5 custom rules, Pro allows 20, Business allows 100, and Enterprise allows 1,000. Check your Cloudflare plan if you're hitting limits.

Does this tool store my Cloudflare API key in plain text?

No. All API tokens are encrypted with AES-256-CBC encryption and verified with HMAC-SHA256 before decryption. Even database administrators cannot read your raw token values.

Can I use the same rule on multiple zones?

Absolutely. That's exactly what Bulk Mode is designed for. Select your zones, select the rules, and apply them all at once.

What happens if I delete a preconfigured rule from my zone?

The rule is removed from Cloudflare, but it remains available in your preconfigured rules library. You can re-apply it anytime.

I manage sites for multiple clients with different Cloudflare accounts. Can I handle that?

Yes. Add a separate API token for each Cloudflare account. Label them clearly (e.g., "Client A — Production"), and switch between them as needed.

Does rule order matter?

Yes, very much. Cloudflare evaluates rules from top to bottom and applies the first matching rule. For example, if you have a "Block all traffic from Germany" rule above an "Allow known good bots" rule, German Googlebot will be blocked. Put the Allow rule first to avoid that.

Can I test a rule before blocking real users?

Yes. Set the rule's action to Log. This records matches without actually blocking or challenging anyone. Check your Cloudflare analytics to see what it's catching, then switch the action to Block when you're confident.

What's the difference between "Challenge," "JS Challenge," and "Managed Challenge"?

• Challenge (CAPTCHA) — Shows a traditional CAPTCHA that users must solve.
• JS Challenge — Runs a JavaScript computation in the background. Most real browsers pass automatically; bots fail.
• Managed Challenge — Cloudflare automatically decides the best challenge type for each request. This is usually the best default choice.

Why can't I delete my only remaining token?

If you have a single token, you can still delete it, but we show "Only token" as a reminder. Once deleted, you'll need to add a new token before you can manage any rules.

Are my custom rules shared between tokens?

Yes. Your custom rule library is tied to your account, not to a specific API token. When you switch tokens, your custom rules are still there — you just apply them to different zones.