Using CloudFlare

You can use CloudFlare to help protect your domain from malicious traffic.

Here are a few options to enable and use to protect your domain with almost no impact on legitimate users.

IP Masking

You can mask your IP by enabling Proxy for your domain's DNS records. For this to be effective it will need to be set for all records that point towards the same IP. Attackers can only see the CloudFlare IP, making it harder for them to attack your server directly. This also enables Unmetered DDoS Mitigation and allows the use of more direct methods like WAF rules and Under Attack Mode.

Web Application Firewall (WAF) and Custom Rules

You can use the WAF to challenge a lot of malicious traffic while allowing legitimate users to still reach your site. Custom rules allow you to set up challenges for specific regions, countries, and even AS numbers. Any traffic from those regions or AS will be presented with a CAPTCHA, allowing legitimate users to still reach your site while keeping bots out.

Custom Rule Examples

Here are some of the rules we use to prevent or mitigate DDoS attacks.
If you are not using CloudFlare PRO, you will need to set them up per domain.

Challenge anyone outside of the EU, while letting legitimate bots through:

Useful if you're not active outside of Europe.

(ip.src.continent ne "EU" and not cf.client.bot)

Challenge specific continents:

(ip.src.continent in {"AF" "AS" "SA" "NA"} and not cf.client.bot)

Challenge countries that are known origins of bot attacks:

(ip.src.country in {"AR" "BD" "BR" "CN" "CO" "CG" "EC" "HK" "IN" "ID" "IQ" "JM" "JO" "KE" "MY" "MX" "MA" "NP" "PK" "PY" "PH" "RU" "SA" "SG" "TT" "TR" "AE" "UZ" "VE" "VN"} and not cf.client.bot)

You can also exclude specific API endpoints with http.request.uri contains.

(ip.src.country in {"AR" "BD" "BR" "CN" "CO" "CG" "EC" "HK" "IN" "ID" "IQ" "JM" "JO" "KE" "MY" "MX" "MA" "NP" "PK" "PY" "PH" "RU" "SA" "SG" "TT" "TR" "AE" "UZ" "VE" "VN"} and not http.request.uri contains ".well-known/acme-challenge" and not http.request.uri contains "/rest/" and not http.request.uri contains "/api/" and not cf.client.bot)

To apply these rules, paste them into the Expression Editor, select Managed Challenge as the action, and add them to your ruleset.

You can find the alpha-2 codes used for countries here

Under Attack Mode (UAM)

UAM is a security option you can enable when your site faces bot attacks. It forces a challenge for all traffic, giving your server breathing room while you investigate.