Use a Cloudflare free or Pro account to stop up to 90% of automatic hacking bots
How to use a Cloudflare free or Pro account to stop up to 90% of automatic hacking bots from reaching your website.
For example: To completely stop automated PHP Argument Injections (RCE), Arbitrary File Uploads, and SQL Injections before they ever reach your new Ubuntu server, you need to route your website's traffic through Cloudflare's network proxy. This places an enterprise-grade Web Application Firewall (WAF) between the hackers and your VPS.
Follow this step-by-step guide to configure Cloudflare specifically for Magento 2.4.6p15.
Step 1: Create a Free Cloudflare Account & Add Your Domain
- Go to Cloudflare.com and click Sign Up.
- Enter your email and a secure password.
- Once logged in, click Add a Site.
- Type your website's domain name (e.g., yourstore.com) and click Add Site.
- Select the Free Plan (which includes the full proxy shield and core WAF security rules) and click Continue.
Step 2: Update Your Domain's Nameservers (Hiding Your Server IP)
Cloudflare will automatically scan your existing DNS records. To activate the shield, you must point your domain to Cloudflare.
- Cloudflare will display two new Nameservers on your screen (e.g., ://cloudflare.com and ://cloudflare.com).
- Open a new browser tab, log into your Domain Registrar account (where you bought your domain, such as GoDaddy, Namecheap, or Google Domains).
- Find the DNS Management / Nameservers section for your domain.
- Choose Custom Nameservers and replace your old nameservers with the two provided by Cloudflare.
- Save the changes. (Note: Nameserver updates can take anywhere from 5 minutes to a few hours to propagate globally).
Step 3: Verify the "Orange Cloud" Proxy is Turned ON
For Cloudflare to block attacks, your traffic must route through their servers. This hides your real VPS IP address.
- Go back to your Cloudflare dashboard and click on DNS > Records.
- Look at your primary A record (pointing to your server IP) and your CNAME records (like www).
- Make sure the toggle cloud icon next to them is Orange (labeled Proxied).
- If it is grey (DNS Only), click Edit, flip the switch to Proxied, and click Save.
Step 4: Turn On the Managed Web Application Firewall (WAF) Rulesets
This is the step that explicitly blocks the SQL injections and PHP argument exploits (-d allow_url_include=1) found in your initial logs.
- In the left-hand sidebar of Cloudflare, navigate to Security > WAF.
- Click on the Managed Rules tab.
- Locate the Cloudflare Managed Ruleset and ensure it is toggled to Enabled.
- Locate the OWASP Top 10 Core Ruleset and toggle it to Enabled.
- Change the Sensitivity setting to Medium or High. This automatically drops malicious code payloads, cross-site scripting (XSS), and malicious parameter injections before they touch your Magento code.
Step 5: Create a Custom WAF Rule to Lock Down Magento Admin & Upload Paths
Because attackers targeted your customer file upload endpoint (/customer/address_file/upload), you can create a custom rate-limit or blocking rule to prevent bot abuse.
- Under Security > WAF, click on the Custom Rules tab.
- Click Create Rule.
- Name the rule: Block Malicious Admin/Upload Probing.
- Under Field, select URI Path.
- Under Operator, select contains.
- Under Value, type your Magento admin path (e.g., /admin) or the file upload path (e.g., /customer/address_file/upload).
- Click And to add a condition. Set the field to Known Bots, operator to equals, and value to Yes.
- Scroll down to Choose Action and select Block (or Managed Challenge to show a CAPTCHA screen).
- Click Deploy.
Step 6: Enable "Under Attack" Mode or "Bot Fight Mode"
To stop headless scraping scripts and automated dictionary-attack loops entirely:
- Navigate to Security > Bots.
- Toggle Bot Fight Mode to On. This forcefully challenges suspicious, automated scripts using JavaScript verification steps, stopping headless scrapers from draining your server's CPU.
- (Optional) If you see a massive spike in automated traffic again, go to the Cloudflare Overview page and toggle Under Attack Mode to On. This forces every visitor to pass a brief security check before loading your home page.
Step 7: Enforce Full SSL Encryption
Ensure hackers cannot intercept customer login data in transit between Cloudflare and your new Ubuntu VPS.
- Navigate to SSL/TLS > Overview in Cloudflare.
- Change your encryption mode to Full or Full (Strict).
- Navigate to SSL/TLS > Edge Certificates and toggle Always Use HTTPS to On.