配置Cloudflare WAF以保护网站

发表于： 分类于：
字数： 292 阅读：≈ 1分钟

配置Cloudflare WAF规则和速率限制,以保护网站免受恶意流量与恶意爬虫的影响

WAF规则

放行

选择跳过,并勾选所有其余自定义规则

(cf.client.bot) or (http.user_agent contains "duckduckgo") or (http.user_agent contains "facebookexternalhit") or (http.user_agent contains "Feedfetcher-Google") or (http.user_agent contains "LinkedInBot") or (http.user_agent contains "Mediapartners-Google") or (http.user_agent contains "msnbot") or (http.user_agent contains "Slackbot") or (http.user_agent contains "TwitterBot") or (http.user_agent contains "ia_archive") or (http.user_agent contains "yahoo") or (http.user_agent contains "bingbot") or (http.user_agent contains "YaBrowser") or (http.user_agent contains "letsencrypt") or (http.user_agent contains "Google-Display-Ads") or (http.user_agent contains "GoogleAdSenseInfeed") or (http.user_agent contains "Googlebot") or (http.user_agent contains "Baiduspider")

拦截恶意流量

选择使用托管质询

(cf.threat_score ge 10 and not cf.client.bot) or (not http.request.version in {"HTTP/1.2" "HTTP/2" "HTTP/3" "SPDY/3.1"} and cf.threat_score ge 10) or (not http.user_agent contains "Mozilla/")

拦截可疑流量

选择使用JS质询

(not http.request.version in {"HTTP/1.2" "HTTP/2" "HTTP/3" "SPDY/3.1"}) or (cf.threat_score ge 4 and not cf.client.bot)

速率限制规则

传入匹配设置为

(http.request.uri.path contains "/")

每10秒请求根据站点访问量自行设置，一般情况下120即可

默认设置

安全级别

设置为高

质询通过期

推荐设置为45分钟(视情况自行修改)

浏览器完整性检查

设置为开启