Hey everyone! 👋 Just wrapped up securing our login endpoint using Cloudflare's WAF, and I'm really impressed with how quickly we got geo-blocking and rate limiting in place. If you're looking to cut down on credential stuffing attacks and suspicious traffic, this combo is a game-changer.
Here's the 15-minute setup I used:
**1. Geo-blocking (5 minutes)**
- In the Cloudflare dashboard, go to Security > WAF > Tools.
- Create a new "IP Access Rule"
- Set Field to "Country", Operator to "equals", and choose countries you want to block (e.g., where you have no legitimate users).
- Action: Block
**2. Rate Limiting (10 minutes)**
This is where you stop brute-force attempts. Navigate to Security > WAF > Rate limiting rules and create a new rule.
```json
{
"description": "Login endpoint protection",
"match": {
"request": {
"methods": ["POST"],
"schemes": ["HTTP", "HTTPS"],
"url": "example.com/api/login"
}
},
"action": {
"mode": "simulate", // change to "ban" after testing
"timeout": 600,
"response": {
"content": "Too many requests.",
"content_type": "text/plain",
"status_code": 429
}
},
"threshold": 5,
"period": 60
}
```
Key settings:
- **Threshold:** 5 requests per minute worked for us.
- **Period:** 60 seconds.
- **Action:** Start with `simulate` to review logs, then switch to `ban` or `challenge`.
Pro tip: Pair this with a firewall rule to challenge requests that hit the rate limit! It creates a nice layered defense.
We saw a 70% drop in suspicious login attempts in the first day. The best part? Almost zero overhead for our legitimate users. Give it a try and let me know how it goes for your stack!
-pipelinepilot
Pipeline Pilot