Block IP's which attack

What is the name of the domain?

hanspeterkruesi.com

What is the issue you’re encountering

IP Blocking Rule

What steps have you taken to resolve the issue?

I have a problem with a lot of bots and scrappers which overload my website. They are mainly from China. How can I make a rule which blocks any IP adress which comes to my page more the 6 times per 10 sec. that it gets blocked. I already created such a rule and allowlisted the folder wherre the CMS is located with /members/* - all seemed fine but when the rule is active I also can not access the site anymore. I just want to block any IP which makes multiple requests to my page.

Was the site working with SSL prior to adding it to Cloudflare?

Yes

What is the current SSL/TLS setting?

Full (strict)

Rate limiting only has simple features on a free plan. Note that if you rate limit for /members/ that will include any files, such as HTML, images, CSS, etc that match that path so a single page visit could hit the rate limit if too low and many files are requested per page visit.

Other than the rate limiter, Cloudflare’s WAF is stateless so each request is evaluated in isolation. You may prefer to use custom WAF rules to block countries or ASNs that you find are abusive (such as in this list) or use Cloudflare’s bot protections (again, better on a paid plan).

Alternatively you can build your own rate limiter using Cloudflare Workers, or consider just challenging requests for that page with a custom WAF rule.

That’s what I thought so this does not work with the rate limit, since it’s not clear how many files, images, html get affected by each hit.

The really heavy traffic is coming from China ( Google Analytics ) - how can i block all traffic from China ?

Or is there a possibility to block allowlisted IP’s - as an example 146.204.* ?

Follow this guide to create custom WAF rules…

You can block by IP, country, ASN and more.