Do shop owners add their sites to Cloudflair

[raiwa]

The cloudflare turnstyle captcha is optional and can be switched off.

Chatgpt:
1. Cloudflare doesn’t require CAPTCHA by default
You can use Cloudflare (CDN, WAF, etc.) without any CAPTCHA at all.
CAPTCHA/challenges are only triggered if you configure rules (e.g. bot protection, login protection, rate limiting).
2. Cloudflare has replaced traditional CAPTCHA
Cloudflare now uses Turnstile, which is a CAPTCHA alternative.
It often runs in the background without user interaction.
Users usually don’t see puzzles unless something looks suspicious.

In fact, Cloudflare explicitly moved away from classic CAPTCHA puzzles entirely.

3. You control when (or if) it appears

You can choose to:

Not use any challenge at all
Use invisible Turnstile (no UI)
Show a checkbox (“I’m human”) only when needed
Force stricter challenges on certain actions (login, forms, etc.)
4. When it’s “not optional”

It becomes effectively required only if:

You enable WAF rules like “challenge all visitors from X country”
You protect forms (login/register/contact) with Turnstile
Cloudflare’s bot protection decides a request is suspicious

[14Steve14]

Thanks Rainer. Lots to think over.

[lambro28]

Had to go cloudflair as well, bots from Russia, and a few others attacking for a few years.

[BatteryTrader]

One of the best things in Cloudflare is rate limiting

I think there is 1 available in the free accounts and 2 in the pro, and it goes up from there.

Now this limits the number of pages that can be hit by a single IP within a certain time period; if it goes over that, then you can serve a 429 error, too many requests, which is better than just blocking a search engine you want visiting your site.

Disclaimer: just a Store owner; below is just my opinion, not instruction.

Now where this fails is with an organisation such as Facebook; they have thousands of IPs, so they just move around them so as not to set off rate limiting limits, but they can still bring down your server.

This is how I get around this.

I set a custom rule ( pretty sure in the free account you have 10, 20 in the Pro) and attempt to block all of Facebook's IP range except a few

This is my expression

Code: Select all

(ip.src.asnum eq 32934 and not ip.src in {2a03:2880:f812:3b:: 2a03:2880:f812:28:: 2a03:2880:f812:6d:: 2a03:2880:24ff:49::})

And any other IP from AS32934 will get a 403 error

Now I can still have Facebook visit, as long as they use one of the IP’s in the list, as I did not want to block Facebook completely, and should one of those IPs get carried away and force lots of connections, they will get a 429 too many code.

Now I do not know if how much effect that will have with Facebook, but I can confirm they do indeed visit, returning 200's or perhaps 301's, just using the iP’s I have listed above, everything else gets a 403.

Nothing special about those IP’s either, just some I picked from the thousands they used in my logs.


If you are still reading and interested, one other thing I do is lay out a Honey Trap, which picks up many undesirables before they get carried away.

And Custom rules

honey.JPG

The list is long, I get them from me server logs and search 404’s for clues, most of them are word press, which I certainly do not have.

And then I present them with a 403

honey 2.JPG

Pretty much at the top of my custom rules list I allow the Google ranges through and “skip” everything else (AS Num equals 15169), been like that for a year now, and been fine

Cloud flare is far from perfect, but when there is any issue, the fact you can just click the Under attack mode, and still allow google and your clients through, and get some sleep to look at it again in the morning, just makes it all worth while