# Using Discourse with Cloudflare: Best Practices **URL:** \ **Category:** Self-Hosting\ **Tags:** how-to, cloudflare\ **Created:** [January 30, 2024, 2:56am UTC](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405 "2024-01-30T02:56:10Z")\ **Posts on this page:** 1\ **Showing post:** 31
**Author:** ![haydenjames](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/haydenjames/32/255678_2.png) [@haydenjames](https://meta.discourse.org/u/haydenjames)\ **Post date:** [March 19, 2026, 3:55pm UTC](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405/31 "2026-03-19T15:55:34Z")
> [@haydenjames](#): > > I will make a proper write-up with the full contents of the rules Finished the Discourse + Cloudflare WAF write-up I mentioned earlier: > **[Cloudflare with Discourse: Setup Guide (WAF & Security Rules) | LinuxBlog.io](https://linuxblog.io/cloudflare-discourse-setup-guide/)** > > Cloudflare WAF custom rules, rate limiting, and bot management for self-hosted Discourse forums. Production-tested with tuning advice. Covers the full custom rule stack I use on my Discourse forum: skip rules for static assets and `/message-bus`, block rules for scanners, ASN and geo challenges, rate limiting tuned for Discourse, and managed rule exceptions. Also found something that needs clarification in the [post creation/edit expression in the official guide](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405): the regex [operator `matches`](https://community.cloudflare.com/t/using-discourse-with-cloudflare-best-practices/602890) requires **Business** plan. So in the article I’ve used a `starts_with` alternative that works on **Pro** plans. Tested on a live forum with real traffic. Looking forward to any suggestions, improvements or if anyone runs into issues with config. --- _[View the full topic](https://meta.discourse.org/t/using-discourse-with-cloudflare-best-practices/293405)._