B2B / Enterprise Web
Bot Attack & Web Scraping Mitigation
A large B2B website was experiencing sustained bot attacks and automated scraping that disrupted normal operations.
Elevated traffic & server errors
A large B2B website was experiencing sustained bot attacks and automated scraping that disrupted normal operations.
Stabilized traffic & error reduction
The site's Cloudflare protections were significantly strengthened while preserving legitimate customer traffic. High-value endpoints received broader protection, rate limiting became more effective, managed WAF protections were enabled, outdated TLS support was removed, and an overly aggressive blocking rule was corrected. The client reported improved site behavior after the changes, and the environment was left with a stronger security baseline and clearer follow-up actions for the remaining WordPress and server-side risks.
Challenge
A large B2B website was experiencing sustained bot attacks and automated scraping that disrupted normal operations.
Assessment
Traffic logs and existing Cloudflare controls were reviewed to distinguish legitimate users from automated clients. Analysis showed the existing Cloudflare configuration already had a solid foundation, including five custom WAF rules and rate limiting. The primary constraint was the Free plan, which limited rule capacity, rate-limiting flexibility, and visibility. I refined several existing controls, expanded protection across high-value endpoints, adjusted overly restrictive rules, and identified additional improvements that would become available after upgrading to Cloudflare Pro.
Solution
I refined the existing Cloudflare configuration rather than replacing it. Before the upgrade, I adjusted WAF behavior, improved endpoint coverage, tuned the available rate-limiting rule, and removed an unnecessary cache rule. After the client upgraded to Cloudflare Pro, I enabled and configured the Cloudflare Managed Ruleset, expanded rate limiting across key storefront and account paths, raised the minimum TLS version to 1.2, and corrected rules that were blocking legitimate traffic instead of challenging it. I also identified additional issues outside Cloudflare, including exposed cPanel/SSH access and an outdated WordPress version requiring remediation.
Result
The site's Cloudflare protections were significantly strengthened while preserving legitimate customer traffic. High-value endpoints received broader protection, rate limiting became more effective, managed WAF protections were enabled, outdated TLS support was removed, and an overly aggressive blocking rule was corrected. The client reported improved site behavior after the changes, and the environment was left with a stronger security baseline and clearer follow-up actions for the remaining WordPress and server-side risks.
Key Takeaways
- A solid Cloudflare baseline can still be limited by plan capabilities and rule capacity.
- Small WAF and rate-limiting adjustments can materially improve protection without disrupting legitimate users.
- Managed protections and broader endpoint coverage become much more effective once the right Cloudflare features are available.
- Cloudflare is only one layer — origin access, WordPress patching, and server exposure still matter.
Evidence
Configuration Snapshots
Selected screenshots from the engagement showing key rule adjustments and follow-up protection improvements.
Have a Security Problem You Need Help Solving?
Tell me what is happening and I will help determine the right next step.