We have access to free cloudfare account because our host is siteground. We have 8 sites listed on our cloudflare account. Our biggest concern right now is bots/attackers are continuously attacking our sites trying to find any vulnerability to the extent that our site server is getting overloaded. We want to block all such traffic either real people and/or bots.
For that purpose, we are looking into the services offered by Cloudfare. If we have to obtain a paid subscription, we are ready to do that. But first, we need to understand the scope of Cloudfare services that will help us resolve this situation. We understand that we can block traffic from certain countries using the filters of Cloudfare firewall. There are also automated DDoS prevention service but how does it block automated bots? Are there any more services that will enable us block suspicious traffic
Thanks for reading and waiting for your replies as we want to resolve this issue asap.
I’m afraid that the major difference between paid tiers in term of “automated protection” is only noticeable on enterprise plan, Cloudflare will handle layer3-4 attacks without you needing to move a single finger (on ALL plans), however, those directed to your site, you must handle them.
Obviously, Cloudflare gives you all the tools you may require to mitigate HTTP/S attacks, but it is not something that you achieve instantly after purchasing a plan, you are given more rules and some advantages over the low tier plans but once again, it’s up to you whether if you are able to use these advantages or not.
The major difference you will notice in paid plans is the “ease” that you have to get in touch with them, if you are facing attacks they will do their best to help you out, the higher the plan, the faster they will get back to you.
Yes, I understand that we will have to use the available tools to the best extent. I am just trying to see if we have better tools on paid tiers to combat the attacks.
We are also considering Sucuri. My concern for that is can we use Sucuri as well as Cloudflare at the same time? Like use Sucuri for security stuff and Cloudflare for speed optimization etc. Or, do we have to stick to one service for everything?
As an old customer of Sucuri, I can’t incise enough on how bad their security will be compared to Cloudflare, theirs is sold as a “security” platform but, it was purchased by certain big company and their original essence was lost, now is a mediocre service that will work well for those who do not really face complex attacks.
If you are concerned about DDoS attacks, the best you can do is using Cloudflare given rules to serve Captcha/JS Challenge to those “conflictive” countries.
On top of that, I recommend buying rate limit as that’s something that not even the smartest bots can bypass.
If those are not enough, you shall install some watchdog on your backend that monitors the load of your backend and based on the load, it enables or disables under attack mode using Cloudflare API.
Ideally, if you do not require of the advertised business features, I’d recommend you to buy the PRO plan and rate limit.