Cloudflare, WAF, and Web Application Security Best Practices

A well-written application is still exposed if the edge in front of it isn't configured. Cloudflare and a properly tuned WAF handle an entire class of attacks before they ever reach your servers.

1. DNS and Proxy Setup

• Proxy (orange-cloud) all public-facing DNS records so origin IPs stay hidden
• Enforce "Full (strict)" SSL mode with a valid origin certificate — never "Flexible" in production
• Restrict origin server firewall rules to Cloudflare's published IP ranges

2. WAF Rules That Matter Most

• Enable managed rulesets (OWASP core rules) as a baseline against common exploits
• Custom rules blocking known bad user agents, suspicious query patterns, and known scanner signatures
• Geo-based or ASN-based challenge rules if attack traffic clusters from specific sources
• Log mode first for new rules — verify no false positives before switching to block

Turn on WAF rules in "log" mode before "block" mode. A misconfigured rule that blocks real users is worse than the attack it was meant to stop.

3. Rate Limiting

• Strict limits on login, signup, and password-reset endpoints — the most common brute-force targets
• Looser, monitored limits on general API traffic to absorb legitimate bursts
• Rate limit by a combination of IP and route, not IP alone — shared corporate IPs shouldn't get blanket-blocked

4. Bot Management

Not all bots are hostile — legitimate crawlers (Googlebot, Bingbot, and AI crawlers like GPTBot and ClaudeBot) need to reach your content for SEO and discoverability. Configure bot rules to challenge or block credential-stuffing and scraping bots specifically, rather than blanket-blocking all automated traffic.

5. Security Headers at the Application Layer

Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

These headers stop entire attack classes (clickjacking, MIME sniffing, some XSS vectors) for effectively zero runtime cost.

6. DDoS Protection

Cloudflare's network-level DDoS mitigation is largely automatic once traffic is proxied — the engineering work is making sure origin servers aren't directly reachable, and that rate limiting protects expensive endpoints (search, uploads, report generation) that a volumetric attack would target specifically.

Bringing It Together

Edge security and application security are complementary, not interchangeable — a WAF catches what your code shouldn't have to, and your code should never assume the WAF caught everything. I configure both layers together as part of any production deployment.

I'm Sandaruwan Jayasundara — Senior Software Engineer | Cloud & DevOps. See AWS cloud architecture for startups or get in touch about securing your infrastructure.