
WordPress site under massive automated attack — Cloudflare Free not stopping it
Hi everyone,
I’m dealing with a serious automated attack against a WordPress website and would really appreciate some advice from the Cloudflare community.
The website is hosted on Hostinger Cloud Startup. It was recently moved behind Cloudflare Free because the traffic/attack was becoming difficult to handle at the origin.
The attack appears to be highly automated and is coming from 150+ unique IP addresses, making simple IP blocking ineffective. The requests are also distributed across different IPs and appear to be targeting the website continuously.
What I’ve tried so far:
- Cloudflare Free plan
- Bot Fight Mode
- Multiple WAF/custom rules
- IP-based blocking
- User-Agent based rules
- Various challenge/block rules
- Reviewing Cloudflare Security Events
Cloudflare is clearly detecting/blocking a significant amount of the traffic, but the problem is that the website itself is still becoming inaccessible/unresponsive, especially during the attack.
From what I can see, this isn't simply a handful of bad IPs — it looks more like a distributed automated attack.
My questions:
- What would be the best WAF strategy for this type of WordPress attack?
- Should I focus on rate limiting, URI/path-based rules, ASN/hosting-provider blocking, or something else?
- Is Cloudflare Free sufficient for this type of attack, or would Pro/Super Bot Fight Mode make a significant difference?
- How can I make sure these requests are stopped at Cloudflare and don't continue consuming Hostinger/origin resources?
- Are there specific Cloudflare rules you recommend for WordPress under this kind of automated attack?
- How can I preserve SEO efforts & what should I make changes in Search Console?
I’ve attached a screenshot showing the traffic pattern.
I’d really appreciate any recommendations from people who have dealt with a similar situation.
Thanks!