[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog-post-free-cloudflare-firewall-woocommerce-prestashop-black-friday":3},{"slug":4,"title":5,"body":6,"summary":7,"tags":8,"author":14,"cover_url":15,"published_at":16,"seo_title":17,"seo_description":18,"reading_minutes":19,"related":20},"free-cloudflare-firewall-woocommerce-prestashop-black-friday","A free firewall in front of your WooCommerce or PrestaShop store before Black Friday: Cloudflare's proxy and Free Managed Ruleset, without breaking payment webhooks","\u003Cp>If your WooCommerce or PrestaShop store runs on your own server or a basic hosting plan, every request from the internet goes straight to PHP: real shoppers, price scrapers, and the bots that try known exploits against every shop they can find. A web application firewall (WAF) sits in front and drops the obvious attacks before they reach your store.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6add99866f13dd01b60c078a\">\u003Cvideo src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6add99876f13dd01b60c0790-0-dda43c6a.mp4\" autoplay muted loop playsinline preload=\"metadata\">\u003C\u002Fvideo>\u003C\u002Ffigure>\n\u003Cfigure data-post-media=\"6add967c6f13dd01b60c062a\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6add967c6f13dd01b60c062f-0-da938674.png\" alt=\"A conceptual view of a web application firewall protecting an e-commerce store.\" loading=\"lazy\">\u003Cfigcaption>A conceptual view of a web application firewall protecting an e-commerce store.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cp>Cloudflare's free plan includes one. It will not make an unpatched plugin safe, but it blocks a set of widely exploited attacks for no money and very little setup. The part that catches shop owners out is not the firewall itself: it is the payment provider's webhook, the background call that tells your store \"this order was paid\". Block that, and customers are charged while the order sits on \"pending payment\". This guide sets up the firewall and keeps those calls working.\u003C\u002Fp>\n\n\u003Ch2>What the free plan actually gives you\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>The proxy.\u003C\u002Fstrong> Your domain's traffic goes through Cloudflare first, and visitors see Cloudflare's addresses instead of your server's.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>The Free Managed Ruleset.\u003C\u002Fstrong> Cloudflare describes it as protection against \"high-impact and widely exploited vulnerabilities\", safe to deploy on most applications. It is a subset of the full Cloudflare Managed Ruleset and, per Cloudflare's getting-started guide, deployed by default on Free plans. The broader Managed Ruleset and the OWASP Core Ruleset need Pro or higher.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Five custom rules.\u003C\u002Fstrong> Enough to add one exception for your payment webhooks and a couple of rules of your own. Regex matching is not available on Free, so rules use plain matches like \u003Ccode>contains\u003C\u002Fcode> and \u003Ccode>eq\u003C\u002Fcode>.\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Ch2>Step 1: move DNS to Cloudflare and switch on the proxy\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Add your domain to a free Cloudflare account. It copies your existing DNS records.\u003C\u002Fli>\n\u003Cli>Check every record against your current DNS provider, especially \u003Cstrong>MX\u003C\u002Fstrong> and \u003Cstrong>TXT\u003C\u002Fstrong> records for email. A missed record here breaks order emails, not the shop.\u003C\u002Fli>\n\u003Cli>Set the shop's \u003Ccode>A\u003C\u002Fcode> \u002F \u003Ccode>CNAME\u003C\u002Fcode> records (the root domain and \u003Ccode>www\u003C\u002Fcode>) to \u003Cstrong>Proxied\u003C\u002Fstrong> (orange cloud). Leave mail-related records \u003Cstrong>DNS only\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003Cli>Change the nameservers at your domain registrar to the two Cloudflare gives you.\u003C\u002Fli>\n\u003Cli>Under SSL\u002FTLS, set the mode to \u003Cstrong>Full (strict)\u003C\u002Fstrong> if your server already has a valid certificate. \"Flexible\" leaves the hop to your server unencrypted and often causes redirect loops in WooCommerce.\u003C\u002Fli>\n\u003C\u002Fol>\n\n\u003Ch2>Step 2: confirm the Free Managed Ruleset is running\u003C\u002Fh2>\n\u003Cp>Do not assume; check. In the dashboard, open your domain's \u003Cstrong>Security\u003C\u002Fstrong> settings and look under web application exploits \u002F managed rules. The Free Managed Ruleset should show as deployed, which appears as a rule with an \u003Cem>Execute\u003C\u002Fem> action. If it is off, turn it on and save.\u003C\u002Fp>\n\u003Cp>Leave it running for a day and look at \u003Cstrong>Security → Events\u003C\u002Fstrong>. You will usually see blocked probes for paths that do not exist on your shop. That is the firewall doing its job. If you see a real customer action blocked (for example a checkout request), note the rule ID before changing anything.\u003C\u002Fp>\n\n\u003Ch2>Step 3: keep payment webhooks out of the firewall's way\u003C\u002Fh2>\n\u003Cp>Find the exact webhook address your payment plugin uses. For the official WooCommerce Stripe extension it is your site URL with \u003Ccode>?wc-api=wc_stripe\u003C\u002Fcode> on the end, for example \u003Ccode>https:\u002F\u002Fwww.example.com\u002F?wc-api=wc_stripe\u003C\u002Fcode>; WooCommerce shows it under \u003Cstrong>WooCommerce → Settings → Payments → Stripe\u003C\u002Fstrong>. PayPal, Mollie, PrestaShop payment modules and shipping\u002Fcourier integrations each have their own; their settings page or the provider's dashboard lists it.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6add967c6f13dd01b60c063e\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6add967c6f13dd01b60c0643-0-810be787.png\" alt=\"Creating a specific exception allows payment notifications to pass through the firewall.\" loading=\"lazy\">\u003Cfigcaption>Creating a specific exception allows payment notifications to pass through the firewall.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cp>Then add one custom rule with the \u003Cstrong>Skip\u003C\u002Fstrong> action (Security rules → Create rule → Custom rules):\u003C\u002Fp>\n\u003Cpre class=\"code-block\">\u003Ccode class=\"hljs\">Rule name:  Payment webhooks skip managed rules\nExpression: (http.request.uri.query contains \"wc-api=wc_stripe\")\n            or (http.request.uri.path contains \"\u002Fwc-api\u002F\")\nAction:     Skip -> All managed rules\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Adjust the expression to the addresses you found, and keep it as narrow as possible: skip only the webhook URLs, never \u003Ccode>\u002Fwp-admin\u003C\u002Fcode> or the whole site. Skipping is reasonable here because providers like Stripe sign every webhook and your plugin checks that signature; the firewall adds little on that one URL.\u003C\u002Fp>\n\u003Cp>One setting cannot be fixed with an exception: \u003Cstrong>Bot Fight Mode\u003C\u002Fstrong>. Cloudflare says it \"may challenge API or mobile app traffic\" and that you \"cannot bypass or skip Bot Fight Mode using WAF custom rules\". A webhook is exactly that kind of traffic. On a shop that relies on webhooks, leave Bot Fight Mode off (Security settings → Bot traffic). The managed ruleset is the part you want anyway.\u003C\u002Fp>\n\n\u003Ch2>Step 4: lock your server so only Cloudflare can reach it\u003C\u002Fh2>\n\u003Cp>A firewall in front is useless if attackers can go around it. Your old server IP is still in DNS history, and scanners hit IP addresses directly. Cloudflare's own advice is to block all traffic to your web server that does not come from Cloudflare's IP ranges, which it publishes at \u003Ca href=\"https:\u002F\u002Fwww.cloudflare.com\u002Fips\u002F\">cloudflare.com\u002Fips\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6add967c6f13dd01b60c0634\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6add967c6f13dd01b60c0639-0-e9e0686b.png\" alt=\"Securing the origin server ensures traffic only arrives via authorized paths.\" loading=\"lazy\">\u003Cfigcaption>Securing the origin server ensures traffic only arrives via authorized paths.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cp>On your own Ubuntu server with UFW, allow web traffic only from those ranges (keep your SSH rule as it is):\u003C\u002Fp>\n\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">\u003Cspan class=\"hljs-keyword\">for\u003C\u002Fspan> ip \u003Cspan class=\"hljs-keyword\">in\u003C\u002Fspan> $(curl -s https:\u002F\u002Fwww.cloudflare.com\u002Fips-v4); \u003Cspan class=\"hljs-keyword\">do\u003C\u002Fspan> \u003Cspan class=\"hljs-built_in\">sudo\u003C\u002Fspan> ufw allow from \u003Cspan class=\"hljs-string\">"\u003Cspan class=\"hljs-variable\">$ip\u003C\u002Fspan>"\u003C\u002Fspan> to any port 443 proto tcp; \u003Cspan class=\"hljs-keyword\">done\u003C\u002Fspan>\n\u003Cspan class=\"hljs-keyword\">for\u003C\u002Fspan> ip \u003Cspan class=\"hljs-keyword\">in\u003C\u002Fspan> $(curl -s https:\u002F\u002Fwww.cloudflare.com\u002Fips-v6); \u003Cspan class=\"hljs-keyword\">do\u003C\u002Fspan> \u003Cspan class=\"hljs-built_in\">sudo\u003C\u002Fspan> ufw allow from \u003Cspan class=\"hljs-string\">"\u003Cspan class=\"hljs-variable\">$ip\u003C\u002Fspan>"\u003C\u002Fspan> to any port 443 proto tcp; \u003Cspan class=\"hljs-keyword\">done\u003C\u002Fspan>\n\u003Cspan class=\"hljs-built_in\">sudo\u003C\u002Fspan> ufw status numbered\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Then delete any older rule that allows 80 or 443 from anywhere (\u003Ccode>sudo ufw delete <number>\u003C\u002Fcode>). Cloudflare adds ranges occasionally, so re-run this every few months. If you are technical, a \u003Ca href=\"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fnetworks\u002Fconnectors\u002Fcloudflare-tunnel\u002F\">Cloudflare Tunnel\u003C\u002Fa> goes further: the server makes an outbound connection to Cloudflare and needs no open web port at all.\u003C\u002Fp>\n\u003Cp>On shared or managed hosting you cannot touch the firewall. Ask your host instead: \u003Cem>\"Can you restrict web access to my account to Cloudflare's IP ranges, or do you support Cloudflare Authenticated Origin Pulls?\"\u003C\u002Fem> Many WordPress hosts have a switch for this.\u003C\u002Fp>\n\n\u003Ch2>Step 5: test a real order before the sales start\u003C\u002Fh2>\n\u003Col>\n\u003Cli>Put Stripe (or PayPal) in test mode and place an order with a test card.\u003C\u002Fli>\n\u003Cli>Confirm the order moves to \u003Cstrong>Processing\u003C\u002Fstrong> by itself within a minute. If it stays on \"pending payment\", the webhook is being blocked.\u003C\u002Fli>\n\u003Cli>In Stripe's dashboard, open the webhook endpoint and check the latest deliveries returned \u003Ccode>200\u003C\u002Fcode>. A \u003Ccode>403\u003C\u002Fcode> means the firewall or Bot Fight Mode stopped it; Security → Events will show which.\u003C\u002Fli>\n\u003Cli>Repeat for every gateway and courier integration you use.\u003C\u002Fli>\n\u003Cli>Switch payments back to live mode.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Stripe can disable a webhook endpoint after it fails repeatedly, so if you find failures, fix them and re-enable the endpoint in Stripe's webhook settings.\u003C\u002Fp>\n\n\u003Ch2>What this does not do\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>It does not patch your shop.\u003C\u002Fstrong> Keep WordPress, WooCommerce or PrestaShop, PHP and every plugin updated. The free ruleset covers widely exploited flaws, not every flaw.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>It does not protect a URL you skipped.\u003C\u002Fstrong> That is why the skip rule names only webhook addresses.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>It does not stop logged-in abuse.\u003C\u002Fstrong> A stolen admin password still works. Turn on two-factor login for every admin account.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Budget an afternoon: an hour for DNS, ten minutes for the rules, and the rest for test orders. Do it now rather than in the week of Black Friday, when a broken webhook costs real orders.\u003C\u002Fp>\n\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fwaf\u002Fmanaged-rules\u002F\">Managed Rules\u003C\u002Fa> (Cloudflare docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fwaf\u002Fget-started\u002F\">WAF: Get started\u003C\u002Fa> (Cloudflare docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fwaf\u002Fcustom-rules\u002F\">Custom rules\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fwaf\u002Fcustom-rules\u002Fskip\u002F\">Skip options\u003C\u002Fa> (Cloudflare docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fbots\u002Fget-started\u002Fbot-fight-mode\u002F\">Bot Fight Mode\u003C\u002Fa> (Cloudflare docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdevelopers.cloudflare.com\u002Ffundamentals\u002Fconcepts\u002Fcloudflare-ip-addresses\u002F\">Allow Cloudflare IP addresses\u003C\u002Fa> (Cloudflare docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fnetworks\u002Fconnectors\u002Fcloudflare-tunnel\u002F\">Cloudflare Tunnel\u003C\u002Fa> (Cloudflare docs)\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwoocommerce.com\u002Fdocument\u002Fstripe\u002Fsetup-and-configuration\u002Fstripe-webhooks\u002F\">Stripe webhooks for WooCommerce\u003C\u002Fa> (WooCommerce docs)\u003C\u002Fli>\n\u003C\u002Ful>","Put Cloudflare's free plan in front of a self-hosted shop in an afternoon: proxy the store, confirm the Free Managed Ruleset is on, lock the server so only Cloudflare can reach it, and keep Stripe and PayPal order notifications flowing.",[9,10,11,12,13],"security","woocommerce","prestashop","cloudflare","ai-assisted","Async.Shop","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6add967a6f13dd01b60c060a-0-4fb2dae8.png","2026-10-25T07:19:14.039Z","Free Cloudflare firewall for WooCommerce and PrestaShop, webhooks intact","Proxy your shop through Cloudflare's free plan, confirm the Free Managed Ruleset, lock the origin and keep Stripe and PayPal webhooks working before Black Friday.",6,[21,34,44],{"slug":22,"title":23,"type":24,"summary":25,"tags":26,"author":14,"cover_url":31,"published_at":32,"updated_at":33},"shop-your-own-store-like-an-ai-agent-pre-black-friday-test-script","Shop your own store the way an AI agent would: a pre-Black-Friday test script","blog","Ask ChatGPT, Claude and Copilot your customers' top questions about your shop, log every wrong or missing answer, and fix the source before Black Friday.",[27,28,29,30,13],"ecommerce","shopify","ai-agents","black-friday","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ae48cd437fa83c1536d8c1a-0-09c57ab4.png","2026-10-31T04:02:11.962Z","2026-10-31T04:02:11.963Z",{"slug":35,"title":36,"type":24,"summary":37,"tags":38,"author":14,"cover_url":42,"published_at":43,"updated_at":43},"shopify-mcp-servers-shopper-ai-what-to-check","What Shopify's MCP servers let a shopper's AI do in your store, and what to check first","Shopify's docs now split what a shopper's AI assistant can do in your store across several servers. A plain-language map of what each exposes, what the docs leave unsaid, and which policy pages to tidy before an assistant reads them aloud.",[28,39,40,41,13],"ai-shopping-agents","mcp","store-policies","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ae1ba761edd7a39ec513077-0-3172c55c.png","2026-10-29T03:19:16.591Z",{"slug":45,"title":46,"type":24,"summary":47,"tags":48,"author":14,"cover_url":53,"published_at":54,"updated_at":55},"etsy-bans-ai-patterns-recipes-what-sellers-must-change","Etsy now bans AI-made patterns, recipes and instructions: what pattern and printable sellers must change, and what AI use is still allowed","On 22 October Etsy banned AI-generated patterns, recipes and instructions, banned bot-made listings and asked for one unedited photo of the real item. A checklist for pattern, recipe and printable sellers: what is at risk, what to fix first, and what AI use is still fine.",[49,50,51,52,13],"etsy","marketplace-policy","digital-products","product-photos","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fasyncshop\u002Fmediagen\u002F6a\u002F6ae038cf1edd7a39ec50fa8a-0-03819514.png","2026-10-27T07:25:13.068Z","2026-10-27T07:25:13.069Z"]