Our site went down and orders are slipping away
We route traffic through Cloudflare, which absorbs the flood and passes only legitimate requests to your server. We add rate limits on the pages attackers usually target.
A website that stays online under attack and bot traffic
We put Cloudflare in front of your site, configure a WAF (a filter for malicious requests) and block bad bots. Your site stays up, ad spend stops leaking into fake clicks, and your forms stop filling with spam.
Quote and schedule after your brief
Who it's for
- Online stores that slow down or crash during sales peaks
- Sites running paid ads where bots waste the budget
- Businesses whose forms and CRM are full of spam leads
- Companies that have already been hit by an attack and want it not to happen again
Problems we solve
Bots fill our forms and sign-ups, and the CRM is full of junk
We add Cloudflare Turnstile (a CAPTCHA alternative that rarely bothers real people) plus bot rules. We then test that real customers and enquiries still go through.
Ad budget disappears and analytics show strange visits
We read the request logs, find suspicious sources and block them by network, country or behaviour. We set exceptions so search crawlers and ad platform checks are not affected.
We worry protection will block real buyers or payments
We start rules in log-only mode, review what they would catch, and only then switch on blocking. Payment providers and webhooks (automatic notifications between services) go on an allow list.
What's included
- Site audit: hosting, DNS, current weak spots
- Domain connected to Cloudflare under the client's own account
- SSL/TLS configuration without redirect loops
- Hiding the origin server IP and closing direct access to it
- WAF rules for common attacks on forms, admin login and vulnerability scanning
- Bot filtering and Turnstile on forms and sign-up
- Rate limiting for login, search and checkout
- Static asset caching, so the site also loads faster
- Post-launch testing: forms, payments, webhooks, Google indexing
- A short runbook: what to check during an attack and how to enable Under Attack mode
Choose the scope
Use a package to describe what you need. We agree on the quote and schedule after reviewing your brief and requirements.
01
Basic protection
A small site or landing page without complex logic
- Cloudflare connection, DNS and SSL
- Baseline DDoS protection
- Turnstile on one form
- Post-launch testing
02
WAF and bots
Online stores, corporate sites and sites with active ad spend
- Everything in Basic
- Custom WAF rules for your CMS
- Bot filtering and rate limiting
- Origin IP hiding
- Exceptions for payments and webhooks
03
Managed protection
Sites where every hour of downtime costs money
- Monthly review of attack logs
- Rules adjusted to new threats
- Fast response during an attack
- Plain-language monthly report
How we work
Brief and requirements
You describe the task and current workflow. We clarify requirements, choose a first stage and prepare a quote.
Cloudflare connection
We create the account under your email, or work inside yours. DNS records are moved carefully so the site does not go offline.
Rules in log-only mode
We switch on the WAF and bot filter without blocking. For a few days we watch which requests would have been flagged.
Blocking goes live
Verified rules move to active mode. We test forms, checkout, webhooks and indexing.
Handover and support
You get all access and a short runbook. If you want, we stay on a monthly plan.
Scope and limits
- We do not promise protection from every attack. Very large, targeted attacks may require paid Cloudflare plans.
- We do not clean already-hacked sites. If malicious code is in your files, that is a separate cleanup job.
- We do not guarantee zero false blocks. Testing keeps them rare, but some edge cases appear and rules need tuning.
FAQ
How much does Cloudflare itself cost?
We prepare a quote after reviewing your brief and requirements. A first stage can cover: cloudflare connection, DNS and SSL; Baseline DDoS protection. Scope, payment and schedule are agreed before work starts.
Will it slow my site down?
Usually the site gets faster, because Cloudflare serves static files from servers near the visitor. Dynamic pages such as carts are excluded from caching so nothing breaks.
Will it block Google or payment providers?
Payment terms are agreed with the quote before work starts. For a staged project, we describe the result and acceptance criteria for each stage. Support and third-party services are listed separately.
Who owns the Cloudflare account?
We agree on the handover of code, materials and account access before work starts. Third-party licences and services are listed separately when needed.
What do I need to provide?
Access to your domain registrar or DNS, plus details of your hosting and CMS. It also helps to know which services send requests to your site, such as payments, CRM or email tools. We find the rest during the audit.
Can we start with a pilot?
Yes. We pick one measurable signal, such as spam submissions or downtime incidents, and track it for a few weeks. Payment is in stages, so you see the effect before paying the full amount.
Start with your task
Describe your business, the outcome you need and your current workflow. We will clarify the requirements and prepare a quote after your brief.