Each attack surface deserves a defense-in-depth strategy

Sun, 11 Oct 2026 20:59:53 -0500

Each attack surface deserves a defense-in-depth strategy. For at least a decade, Cloudflare has given each domain 5 free WAF rules. I have yet to find a single business using them well. Did I mention they’re FREE?

Prompt: Configure Cloudflare WAF custom rules for a business website: block unused HTTP methods, common bot scanner paths and exploit patterns, Tor exit nodes, and traffic from non-existent or extremely low-population locations, then apply a Managed Challenge to everything that is not from the US, MX, or CA (exempt known good bots and well-known paths).

Cloudflare on Andrew Healey

Each attack surface deserves a defense-in-depth strategy