Anti-DDoS with Cloudflare

For two consecutive months, my website was bombarded by intense attacks from morning to afternoon, causing performance to drop drastically and operations to grind almost to a halt.

AtVPTS, we fully understand this threat and constantly stand by you to protect your digital assets. Cloudflare—one of the world's leading security and performance optimization platforms—serves as an effective, easily deployable solution to thwart DDoS attacks right at the network edge.

In this article, VPTS will guide you step by step to configure Cloudflare for DDoS protection for websites or VPS, helping you:

• Protect systems against cyberattacks,

• Accelerate access with a smart CDN system,

• Improve stability and reliability for your website.

Get started now for proactive defense – peace of mind in operations!

1. What is CloudFlare?

What is Cloudflare?

Cloudflare is a technology company specializing in security, performance optimization, and content delivery network (CDN) services for websites and web applications. Simply put, Cloudflare helps protect and accelerate your website by acting as an intermediary layer between users and your origin server.

Benefits of using Cloudflare

• Anti-DDoS Security: Automatically detects and prevents Distributed Denial of Service (DDoS) attacks.

• Accelerate websites: Thanks to a global server network (CDN), Cloudflare reduces page load times by caching content closer to users.

• Free HTTPS Encryption: Supports free SSL certificates to secure website connections.

• Hide origin server IP: Helps conceal the actual IP address of the server to prevent direct attacks.

• Access analytics: Provides detailed reports on traffic, threats, and performance.

2. Guide to DDoS Protection Using "Under Attack Mode"

Step 1: Log in to your Cloudflare account

• Access Cloudflare Dashboard

• Log in and select the domain you want to protect.

Example: I will choose the domain devttt.com

Step 2: Go to Overview and enable Under Attack Mode

• In the left menu bar, click Overview to access the website's main dashboard.

• Scroll down to the Quick Actions section in the right column.

• Here you will see the Under Attack Mode option; toggle the switch to ON.

Step 3: Check status

• After activation, users visiting the website for the first time will see a security check page.

• Check the "Verify you are human" box – this is a simple captcha to verify users.

• Wait a few seconds for Cloudflare to evaluate the security of your device's connection.

• After successful verification, you will be automatically redirected to the main website

According to VPTS's assessment, this feature is only truly effective against small-scale DDoS attacks, mainly from auto-F5 tools or novices unfamiliar with attack techniques. However, if attackers are savvy, they only need to set a delay greater than 5 seconds to bypass verification, and can then launch attacks as normal—leaving the system still vulnerable to crashing.

In reality on the internet, most tutorials only stop at enabling Under Attack Mode without going deeper.

In the initial phase of the attack—when the attacker only used a few isolated IP addresses—the VPTS team was still able to monitor access logs and manually block suspicious IPs via Cloudflare's Firewall feature.

3. Guide to blocking IP with WAF on Cloudflare

Step 1: Access the WAF section

• From the main Cloudflare interface, select Security.

• Then, click WAF in the left menu to open the Web Application Firewall management interface.

Step 2: Add an IP blocking rule

• In the IP Access Rules section, you will see input fields as shown in the image

• Under IP, IP range, country name, or ASN, enter the IP address or IP range you want to block.

• Under Action, select Block to deny access.

• Under Zone, select the target website domain.

• The Notes section is for remarks to help you easily track the reason for blocking an IP.

• After filling in all details, click the Add button to finish.

4. Guide to Anti-DDoS with Firewall Rules

Step 1: Access the WAF section

• From the main Cloudflare interface, select Security.

• Then, click WAF in the left menu to open the Web Application Firewall management interface.

• Switch to the Custom rules tab – where you can create tailored protection rules for your domain.

• Click the Create rule button to start creating a new rule.

With the Free plan, you can create up to 5 custom rules—enough to handle most basic attack scenarios or filter suspicious traffic.

Analysis of VPTS's protection strategy:

In reality, most DDoS attacks originate from foreign IP addresses. Meanwhile, VPTS's website primarily serves Vietnamese users with pure Vietnamese content, so allowing traffic from international IPs is not truly necessary.

Therefore, VPTS proactively configured a Cloudflare rule to block all foreign IPs. This minimizes attack risks from undesirable sources and optimizes access performance for domestic users.

However, to avoid affecting indexability on search engines like Google, Bing, Yandex..., VPTS has also added rules allowing reputable bot IPs through the firewall system.

Step 2: Configure rule

• Rule name: Name the rule, for example: VN Block.

• Field: Select Country.

• Operator: Select is in.

• Value: Enter the country to apply – for example: Vietnam (or any other country you want to control).

• In the Expression Preview section, Cloudflare will display the corresponding syntax.

Step 3: Select action

In sectionThen take action..., select:

• Interactive Challenge: forces visitors to complete an interactive challenge (usually CAPTCHA).

• Or select Managed Challenge for an advanced protection layer (Cloudflare recommends this option).

5. Guide to adjusting security level and challenge passage time on Cloudflare

Step 1: Set security level

• From the main Cloudflare interface, select Security.

• Then, click Setting in the menu bar.

• You can adjust the security level by selecting levels such as:
  Essentially Off, Low, Medium, High, and I’m Under Attack!

Step 2: Create the security.txt file

• Enable Security.txt: This feature allows you to generate a security.txt file, helping security researchers get in touch and report vulnerabilities if found.

• You can turn it on by toggling the switch to the right.

Step 3: Configure real time

• You can set the challenge's validity period after a user passes it.

• Example: Select 5 minutes, which means after completing verification, users can access without re-verification for 5 minutes.

• Under “Challenge Passage”, VPTS sets a duration of 1 week before the system re-displays the security challenge interface to client IPs that previously passed verification.

• The purpose of this configuration is to balance security and user experience, avoiding continuous verification that annoys legitimate visitors.

6. Conclusion

After fully applying the Cloudflare configuration steps as instructed, your website will be reinforced against DDoS attacks—from small-scale to more organized attacks. With features like “Under Attack Mode”, IP Access Rules, Custom Firewall Rules, and Challenge Passage, Cloudflare helps control and filter traffic intelligently and effectively.

TeamVPTShopes that the guide above has provided you with a practical and easily deployable solution to protect your system from today's common threats.

If you need further assistance during setup or security optimization, do not hesitate to contact VPTS – we are always ready to accompany you every step of the way to protect your website.

VPTS – Comprehensive Digital Infrastructure Solutions Provider

VPTS Team Contact Information