For sites on Cloudflare, the site’s Security tab gathers the protections you control yourself: I’m Under Attack mode, your own firewall rules, bot protection and email address protection.
💡 Being hammered right now?
Turn on I’m Under Attack and choose to switch it off automatically after 1, 6 or 24 hours, so you do not have to remember.
I’m Under Attack mode
Every visitor is checked by the CDN before reaching your site, which stops most floods of bad traffic. While it is on it also affects blueprint screenshots of the site, uptime monitors, SEO and marketing tools, API and webhook integrations and some bots and RSS readers – so switch it on when you need it and let it turn itself off. When it goes off, the previous security level comes back.
Your own firewall rules
Block, challenge or allow traffic by IP address or range, network (AS number), country, path or request method, and switch each rule on or off. There are two kinds: custom rules and rate-limiting rules (a limit on requests per period). The number of each is limited by the CDN’s plan, and the tab shows how many you have used. Rules made directly in a Cloudflare account show here read-only.
Bot protection
- Block AI crawlers (on by default): blocks crawlers that harvest content to train AI models. Google, Bing and other verified search engines are not affected.
- Bot Fight Mode (off by default): challenges every visitor the CDN believes is automated. It also breaks blueprint screenshots, uptime monitors, SEO tools and integrations, so turn it on only while bots are a problem.
- Turnstile is separate from the settings on this page: it is its own free Turnstile tab and checks your forms specifically (login, sign-up, comments, contact) with a small “Verify you are human” box, rather than challenging every visitor to the site. See Turnstile – stop bots on your WordPress forms.
Email address protection
On by default: Cloudflare hides the e-mail addresses on your pages from spam bots by turning each one into a /cdn-cgi/l/email-protection link plus a small script. If an SEO tool such as Ahrefs or Semrush reports those links as broken (404), press Turn off email address protection in the same tab – your choice is kept for the site. Email address protection explained.
From the API or your AI assistant
Everything on the Security tab also works from our API and from any AI assistant connected to your account (ask it, for example, “block visitors from one country on example.com”). Give the key the security permissions; the same limits and checks apply as here.