Cloudflare WordPress Rules

Bash scripts that create and manage Cloudflare WAF rules, API tokens and Turnstile widgets for WordPress sites, using the Cloudflare Rulesets API.

Docs https://managingwp.github.io/cloudflare-wordpress-rules/ · Rule generator https://managingwp.github.io/cloudflare-wordpress-rules/generator/

Beta rules (staging)

Unreleased rule changes live in profiles/mwp-rules-beta.json; the generated rules are on the Beta rules page.

./cfwr.sh -v1 -d staging.example.com -c create-rules mwp-rules-beta

Quick start

Requires bash, curl, jq, a Cloudflare account and an API token with Rulesets API permissions.

git clone https://github.com/managingwp/cloudflare-wordpress-rules.git
cd cloudflare-wordpress-rules
cp .cloudflare.example ~/.cloudflare    # then add your account and token
./cfwr.sh -v1 -d example.com -c create-rules default

Rule generator

The rule generator builds the same R1–R4 rules in the browser: pick a preset, adjust countries, IPs, user agents and ASNs, then copy dashboard expressions, ref-tagged Rulesets API JSON (later upgrades keep your own rules) or a v3 profile. Free-plan limits are counted live; nothing leaves the browser.

Documentation

Section	Contents
Getting started	Installation, ~/.cloudflare authentication
Guides	Profile workflow, multi-zone runs, skip/block/rate limiting, Rulesets migration
Commands	The three scripts and their flags
Rule generator	Open the app — presets, options, outputs; how it works
Reference	Profile schema, stable and beta rules, Rulesets API
Contributing	Build, tests, release workflow, docs site

Contributing

Conventions live in AGENTS.md; release notes on the release notes page. The offline tests need no credentials:

bash tests/test-generator.sh && bash tests/test-docs-site.sh

Rule changes follow the beta → release flow in the profile management guide.