Cloudflare is retiring Page Rules in favor of WAF Custom Rules, prompting WordPress site administrators to migrate their admin protection setups.

{
  "signal_id": "31058ee6-ae3d-5de4-a643-d379dd442f9d",
  "signal_type": "reddit-company",
  "signal_subtype": "productChange",
  "detected_at": "2026-10-24T04:22:24+00:00",
  "company": {
    "name": "Cloudflare",
    "domain": "cloudflare.com"
  },
  "data": {
    "nsfw": false,
    "stage": "confirmed",
    "awards": 0,
    "timing": "in_progress",
    "topics": [
      "security",
      "waf",
      "page rules",
      "wordpress"
    ],
    "post_id": "1xdz404",
    "summary": "Cloudflare is retiring Page Rules in favor of WAF Custom Rules, prompting WordPress site administrators to migrate their admin protection setups.",
    "category": "discontinued",
    "comments": [
      {
        "url": "https://www.reddit.com/r/Wordpress/comments/1xdz404/comment/19rkgfpvy5g74/",
        "depth": 0,
        "score": 16,
        "author": "urosevic",
        "excerpt": "If the site isn’t a membership site, set up Cloudflare One (formerly Zero Trust) for the admin and login URL.\n\n You’ll need to allow access to these URLs only from the CF IPs to prevent direct access by bypassing CF. That’s done in the web server config.\n\n This stops brute force and any login attempts from unauthorised users.",
        "posted_at": "2026-10-24T05:19:20.000Z",
        "author_url": "https://www.reddit.com/user/urosevic/"
      },
      {
        "url": "https://www.reddit.com/r/Wordpress/comments/1xdz404/comment/19rkfo4myngw0/",
        "depth": 0,
        "score": 8,
        "author": "MakeItJumboFrames",
        "excerpt": "There's a thread somewhere from a few months ago. Look for Cloudflare WAF rules. Gives some good guidance on what you can do to help protect those specifically.\n\n Here's one: https://www.reddit.com/r/CloudFlare/s/Qmwohfz6uC\n\n There are several if you search cloudflare waf wordpress wp-admin",
        "posted_at": "2026-10-24T05:02:09.000Z",
        "author_url": "https://www.reddit.com/user/MakeItJumboFrames/"
      },
      {
        "url": "https://www.reddit.com/r/Wordpress/comments/1xdz404/comment/19rkgd09shzr7/",
        "depth": 0,
        "score": 4,
        "author": "Ganiscol",
        "excerpt": "Additionally hide wp-login.php behind something cryptic, impossible to guess. That stopped all bot attempts permanently for me because all they get is a 404.\n\n Name of the plugin is WPS Hide Login.",
        "posted_at": "2026-10-24T05:17:39.000Z",
        "author_url": "https://www.reddit.com/user/Ganiscol/"
      },
      {
        "url": "https://www.reddit.com/r/Wordpress/comments/1xdz404/comment/19rkev4gro5z4/",
        "depth": 0,
        "score": 3,
        "author": "stitchkingdom",
        "excerpt": "my wp-login is behind .htaccess",
        "posted_at": "2026-10-24T04:44:05.000Z",
        "author_url": "https://www.reddit.com/user/stitchkingdom/"
      },
      {
        "url": "https://www.reddit.com/r/Wordpress/comments/1xdz404/comment/19rkj160ax1dw/",
        "depth": 0,
        "score": 3,
        "author": "mrbrendo",
        "excerpt": "If url full contains wp-login.php then interactive challenge\n\n Add second line if url full contains my-account if you have woocommerce",
        "posted_at": "2026-10-24T06:17:32.000Z",
        "author_url": "https://www.reddit.com/user/mrbrendo/"
      },
      {
        "url": "https://www.reddit.com/r/Wordpress/comments/1xdz404/comment/19rkrylqclnpd/",
        "depth": 0,
        "score": 2,
        "author": "tuhin846",
        "excerpt": "Maybe use Cloudflare WAF custom rules to allow only your own IP to access WordPress login endpoints?\n\n If you want to try a security plugin, SiteFort Security comes with a custom login URL feature. It also includes Cloudflare integration to sync local firewall bans with Cloudflare, including automatic bans for scanner probes and brute-force login attacks.",
        "posted_at": "2026-10-24T09:37:43.000Z",
        "author_url": "https://www.reddit.com/user/tuhin846/"
      },
      {
        "url": "https://www.reddit.com/r/Wordpress/comments/1xdz404/comment/19rkxve146jb8/",
        "depth": 0,
        "score": 2,
        "author": "hopefulusername",
        "excerpt": "Security rules or Cloudflare One.\n\n Security rules are easier to setup, just add a rule that restrict the login to an IP.",
        "posted_at": "2026-10-24T11:50:14.000Z",
        "author_url": "https://www.reddit.com/user/hopefulusername/"
      },
      {
        "url": "https://www.reddit.com/r/Wordpress/comments/1xdz404/comment/19rkejghtzwat/",
        "depth": 0,
        "score": 1,
        "author": "LetsGetCloudy",
        "excerpt": "Yep already running wordfence but wanted to reduce attacks on wp login. In the past I created a rule so it would prompt that you are a real human when trying to access wp admin. Then still had wordfence doing 2FA. I’m deploying another site in cloudflare and no longer see a way to do this in page rules.",
        "posted_at": "2026-10-24T04:36:49.000Z",
        "author_url": "https://www.reddit.com/user/LetsGetCloudy/"
      }
    ],
    "evidence": [
      "[post] I’ve done this in the past with page rules but recently read something about them being retired.",
      "[comment u/Datixro] Page Rules are being phased out, but Custom Rules under Security > WAF do the same job and are more flexible.",
      "[comment u/raeesbuilds] Yes, Page Rules are being retired, and for this use case the replacement is a WAF custom rule, not a redirect or cache rule."
    ],
    "virality": "high",
    "post_date": "2026-10-24T04:22:24.000Z",
    "post_kind": "text",
    "post_text": "What’s the best way to protect wp login and wp admin with Cloudflare now days. I’ve done this in the past with page rules but recently read something about them being retired.",
    "sentiment": "neutral",
    "subreddit": "Wordpress",
    "event_date": "2026-10",
    "post_title": "Protect wp login with Cloudflare",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/Wordpress/comments/1xdz404/protect_wp_login_with_cloudflare/",
    "entity_role": "subject",
    "post_author": "LetsGetCloudy",
    "upvote_ratio": 0.9090909090909091,
    "mention_count": 22,
    "mention_surge": true,
    "subreddit_url": "https://www.reddit.com/r/Wordpress/",
    "total_upvotes": 18,
    "comments_total": 39,
    "total_comments": 39,
    "event_date_text": "recently",
    "post_author_url": "https://www.reddit.com/user/LetsGetCloudy/",
    "signal_category": "event",
    "comments_included": 18,
    "products_mentioned": [
      "Page Rules",
      "Cloudflare WAF",
      "Cloudflare One",
      "Cloudflare Zero Trust"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/31058ee6-ae3d-5de4-a643-d379dd442f9d \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"cloudflare.com","limit":20}'