A rule for the path that is being hit. Not Under Attack mode as a permanent setting.
xmlrpc, a login flood, a country you do not sell to. The managed ruleset stays. A custom block is added only for a path the log names. wp-admin is not blocked for everyone.
One rule, then the firewall event that proves it
xmlrpc.php if you do not use the app. A plugin endpoint that is being posted to. We block that URI. We do not block POST on the whole site.
A checkout or an API that the managed ruleset caught. A skip rule for that path, not a disabled WAF. The event log is the evidence.
A challenge for a flood, for an afternoon. Left on, it is a captcha in front of customers. We turn it off when the log is quiet.
A WAF does not close SSH, and it does not clean a site
The origin is still reachable if the firewall allows the old IP. A compromised WordPress is the other page. The WAF plan is yours. Free can do a custom rule. A managed ruleset needs the paid plan, and we will say if the free zone cannot do what you asked.
€55 an hour. The Cloudflare plan is not in it.
Minimum 1 hour. Member access, not the owner password. You remove us when the rule is matching the log and checkout still works.
Login flood, or a rule blocking a customer?
Tell us the domain and the path. No owner password in the first message.