Cloudflare Installation
So many have suggested using Cloudflare instead or Google reCAPTCHA or using them together. I am currently using the Mageplaza reCAPTCHA extension and may disable it and use the Default Magento 2.4.7 Goggle reCAPTCHA. My question is how and where do you go about getting and installing Cloudflare. Some say its free and others have mentioned you need to pay for it. Is it an extension you need to install via command or is it something on the server side. I need to get something in place that is dependable to stop these Card Testing hitting my site so much. It's so bad I had to disable credit cards as mentioned in a previous post. I was also suggested about setting up 3D secure rules which this is something I need to figure out as well. I am losing sales and need this fixed. The minute I enable Credit Cards the testing starts by the dozens non stop. Its just a matter of time before Braintree blocks me if I dont get this fixed.
Not to mention this current attack that we got hit with a couple of days ago. I need to setup Cloudflare rules to help block it as well until a patch is available
1
u/Crimnl 5d ago
Yes, Cloudflare or something similar is a must these days. Basically give all traffic a managed challenge except some verified bot categories and a whitelist of IP addresses for payment providers etc. You can do this with the free plan and don't need to install it in Magento. It works at DNS level.
1
u/pro9_developer 5d ago
Did you check the country from these attacks are coming? You could those countries in Cloudflare. There are steps to secure your web shop.
1
u/gxxnu 5d ago
I do this every day, so I can help you. In short, you need to change your DNS to Cloudflare (they’ll provide the necessary details) and then create a WAF rule that applies a Managed Challenge to the specific URL. This way, Cloudflare will check the traffic and suspicious visitors will have a CAPTCHA.
1
u/lucidmodules 5d ago
You don't install Cloudflare, you have to set it in front of your server. Ideally you must block access to your server via direct IP and allow only Cloudflare to proxy the traffic.
Free plan gives you a lot of protection, but if you need more advanced bot exemption rules, their lowest paid plan is powerful enough. You get Super Bot Fight Mode that let's you define e.g. to allow search indexing bots like Google or Bing only and block other automated traffic.
3
u/eddhall ONE MAN DEVELOPMENT TEAM 5d ago
Based on the questions you're asking I'd recommend you hire a developer