When the critical PHP2Shell vulnerabilities were disclosed on 21 October, sites behind Cloudflare had an extra layer of defence before most people had even heard about the problem. Cloudflare reports it rolled out firewall rules against the attack about nine hours ahead of public disclosure, and switched them on automatically for every plan with its firewall enabled, including the free one. It’s a good example of why we recommend putting client sites behind Cloudflare.
What is Cloudflare?
Cloudflare sits between your website and the people (and bots) visiting it. Instead of visitors connecting directly to your server, their traffic passes through Cloudflare’s global network first, where it can be filtered, protected and sped up.
What it does for your site’s security
- Web Application Firewall (WAF). Cloudflare inspects incoming requests and blocks known attack patterns, such as attempts to exploit vulnerabilities in WordPress, plugins or PHP itself. Its managed rules are updated as new threats appear, often before a patch has been applied to your server.
- DDoS protection. Floods of fake traffic designed to knock a site offline are absorbed by Cloudflare’s network rather than your hosting.
- Hiding your server. Visitors only see Cloudflare, not your server’s real address, which makes it harder to attack directly. We also lock the server down so it only accepts traffic coming through Cloudflare.
- Bot management. Automated scrapers, spam bots and password-guessing scripts can be challenged or blocked, keeping your login page and forms far quieter.
- Locking down the admin area. We can restrict access to your WordPress login and dashboard so only approved people or locations can reach it, and add rate limiting so repeated login attempts get blocked.
- HTTPS everywhere. Cloudflare handles SSL certificates and forces secure connections, so data between your visitors and your site is always encrypted.
- Spam-free forms. Cloudflare Turnstile replaces annoying “click all the traffic lights” CAPTCHAs with an invisible check that stops bots without bothering real people.
A bonus: speed
Because Cloudflare caches your site across data centres worldwide, pages load faster for visitors wherever they are, and your server has less work to do. Faster sites also tend to rank better and convert better.
It’s not a replacement for good maintenance
Cloudflare is a strong extra layer, not a substitute for keeping things up to date. Even with its PHP2Shell protections in place, Cloudflare told customers to patch PHP anyway, and noted attackers were already tweaking their payloads to try to slip past the rules. That’s why we pair Cloudflare with regular updates to PHP, WordPress, themes and plugins, plus backups and monitoring.
Want it on your site?
For most sites, setting up Cloudflare takes [under an hour] with no downtime, and the free plan covers a lot of what’s above. If you’d like us to set it up or review your current setup, get in touch.