by Jaime Alnassim 0 (0 reviews)

WAF Manager for Cloudflare

Name: WAF Manager for Cloudflare
Author: Jaime Alnassim

Deploy five battle-tested Cloudflare WAF rules to any zone in one click, straight from WordPress. No expression language required.

WAF Manager for Cloudflare ranks #33,947 among WordPress.org plugins with 10+ active installations, is #1,834 of 5,058 in the Security category, and was last updated Oct 29, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v1.0.26 Current Version v1.0.26

Updated 1 week ago Last Update on 29 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#1,834 of 5,058 in Security Top 50% by installs Downloads -78.4% this week Actively maintained

View on WordPress.org

Rank

#33,947

— No change

Active Installs

10+

+66.7%

KW Avg Position

103.5

0.5 worse

Downloads

570

+2 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 20

Total Progress 70%

10+ 20+

10,774

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 3 more installs to reach 20+

Rank Changes

Current #33,947

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.0.26
Last Updated: Oct 29, 2026
Requires WP: 6.0+
Tested Up To: 7.1.4
PHP Version: 8.0 or higher
Author: Jaime Alnassim

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

cloudflare firewall hardening security WAF

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

Frequently Asked Questions

Common questions about WAF Manager for Cloudflare

No. Deploying replaces only this plugin's own rules (named "[CF WAF] ...") and keeps your other custom rules on the zone, placed after the plugin's rules so Rule 1 still runs first. If you want a clean zone, tick "Replace all custom rules in the zone" before deploying; you will be asked to confirm. Managed rules, rate limiting rules and other Cloudflare settings are not changed either way. My Free zone says it has no room for more rules. The Cloudflare Free plan allows five custom rules in total, and this plugin uses five. If the zone already has rules of its own, either remove them in Cloudflare or deploy with "Replace all custom rules in the zone".

Yes. When Cloudflare restricts a rule phase on your plan, the plugin removes it and retries so the deploy still succeeds.

No. Every rule is built from checkboxes, and the plugin writes the expressions for you. You can review them on the Expressions tab before deploying.

In Cloudflare, check Security > Analytics > Events to see which rule blocked it. Then allow it in Rule 1: turn on its bot category or service, or add its IP addresses (preferred, since user agents are easy to fake), user agent or a Custom Allow Expression, and deploy again.

Credentials are encrypted at rest using libsodium (sodium_crypto_secretbox), with a key derived from your site's AUTH_KEY salt, so the key is unique to your site and is never stored in the database. Credentials are saved with autoload disabled and are never sent back to the browser. Use a scoped API Token with only the permissions listed above rather than your Global API Key.

The October 2026 ruleset no longer allows services by user agent, because a user agent is easy to fake. Services Cloudflare verifies are covered by "Allow every Cloudflare verified bot", and services that publish their IP addresses have their own switch. Services that do neither, such as UpdraftPlus and BackupBuddy, were moved into Custom User Agents to Allow so nothing stops working, and a notice on the WAF Rules screen lists them.

Yes. Define them in wp-config.php and the plugin uses them read-only: define( 'WPWAF_API_TOKEN', 'your-cloudflare-api-token' ); Or, with a Global API Key: define( 'WPWAF_API_EMAIL', 'you@example.com' ); define( 'WPWAF_API_KEY', 'your-global-api-key' );

By default all plugin data is kept, which is safe for testing or temporary removal. To remove everything on delete, turn off "Keep data on uninstall" in Settings before deleting the plugin.