Finished the Discourse + Cloudflare WAF write-up I mentioned earlier:
Covers the full custom rule stack I use on my Discourse forum: skip rules for static assets and /message-bus, block rules for scanners, ASN and geo challenges, rate limiting tuned for Discourse, and managed rule exceptions.
Also found something that needs clarification in the post creation/edit expression in the official guide: the regex operator matches requires Business plan. So in the article I’ve used a starts_with alternative that works on Pro plans.
Tested on a live forum with real traffic. Looking forward to any suggestions, improvements or if anyone runs into issues with config.