I have setup cloudflare to block access to WordPress back-end with following WAF rule. It somehow lets me access back-end from other countries other than countries other than Germany and UK.

It was working in past for other site however today i tried configure this for different domain and its not working..

enter image description here

I want users to access back end of website only from Germany and United Kingdom

enter image description here

  • What does "not working" mean? Blocking too much? Blocking too little? Error message? Commented Dec 7, 2023 at 10:48
  • It should let me access to backend of Wordpress only from two countries Germany and United Kingdom. When i test i can access website backend pages from all countries example.com/wp-admin
    – Learning
    Commented Dec 7, 2023 at 10:51
  • Is there more to the rule you shared in your screenshot? I don't see anything that says it should be blocked, just what the request matches. Commented Dec 7, 2023 at 10:57
  • So only these 3 condition for this rule (http.host eq "example.com" and http.request.uri.path contains "/wp-admin/" and not ip.geoip.country in {"DE" "GB"})
    – Learning
    Commented Dec 7, 2023 at 11:01
  • 1
    The rule is correctly set. I would simplify it by deleting the first part (hostname) as you can do it with just the URI-Path and Country. The ORDER of rules is important, perhaps there's another rule that is allowing access. Commented Dec 28, 2023 at 21:59

1 Answer 1


I did manage to make it work after i only added URI path contains and Country..

  • Please accept this answer so users know this question has been answered.
    – John Conde
    Commented Dec 29, 2023 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.