# Using Discourse with Cloudflare: Best Practices

**URL:** https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405
**Category:** Self-Hosting
**Tags:** how-to, cloudflare
**Created:** [January 30, 2024, 2:56am UTC](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405 "2024-01-30T02:56:10Z")
**Posts on this page:** 1
**Showing post:** 26

<div class="post-metadata">

### Author: ![haydenjames](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/haydenjames/32/255678_2.png) [@haydenjames](https://meta.discourse.org/u/haydenjames)
#### Post date: [March 10, 2026, 7:28pm UTC](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405/26 "2026-03-10T19:28:53Z")

</div>

Hopefully it’s helpful, but I also wrote a general guide to the best settings here:

> **[Recommended Cloudflare Performance & Security Settings (Guide) | LinuxBlog.io](https://linuxblog.io/recommended-cloudflare-performance-security-settings-guide/)**
>
> Cloudflare is a great tool for website performance and security. They have a whole suite of tools to help with performance and security and are a staple

A Cloudflare staff member also added some pointers and corrections in the comments section.

I’m updating that guide and was trying to see if there was any new advice from Discourse and found this page.

> [@Discourse](#):
>
> ```plaintext
> (http.request.uri.path eq "/posts(/[0-9]+)?" and http.request.method in {"POST" "PUT"})
> 
> ```
> 
> 1. For [Data Explorer](https://meta.discourse.org/t/32566?silent=true) plugin users, skip WAF on admin queries:
> 
> ```plaintext
> (http.request.uri.path contains "/admin/plugins/explorer/queries/" and http.request.meth
> 
> ```

I will be adding these to my managed rules. Thank you!

Here’s an overview of my custom rules. This has really help reduce spam and often times (not always) some of the lowest quality traffic comes in via VPNs and DC traffic which these have helped:

 ![image](https://global.discourse-cdn.com/meta/original/4X/9/f/7/9f79f5a6186f31085d1e935fb72bdf0c213ae8c7.png)

I will make a proper write-up with the full contents of the rules, have been running these for about 6 months and validating their success by using the Log Explorer tool and inspecting 10k events at a time.

---

_[View the full topic](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405)._