You can skip the Cloud tab if you are not already on Cloudflare. The plugin plus Hub is enough. You never change DNS. Use this only if your site is already on Cloudflare. You do not change nameservers again. You make a small token. We lock it. We push Bedrock Shield rules to your zone.

Make the token like this:

1. Open Cloudflare in your browser. Sign in.
2. Click your picture in the top right. Click API Tokens.
3. Click Create Token.
4. Click Create Custom Token.
5. Name it Bedrock Shield.
6. Under Permissions, add two rows. First: Zone, Zone, Read. Second: Zone, WAF, Edit.
7. Under Zone Resources, choose Include, then Specific zone, then pick the site you want to protect.
8. Click Continue to summary. Click Create Token.
9. Copy the token now. Cloudflare shows it once.
10. In Hub, open Cloud. Paste the token. Enter your Hub password. Pick the zone. Click Turn on.

Paste the token Cloudflare showed. Do not paste a Global API Key, a web address, or the word Bearer. If the token can list zones but cannot edit WAF, add Zone, WAF, Edit and paste a new token.

2.1.175 refuses a hash_check restore that extracts files unless the archive still lists file hashes. Extra Show stays passwordless. 2.1.174 refuses a bound restore when extracted files are not in the listed hashes. Extra Show stays passwordless. 2.1.173 refuses a hash_check restore that lists a SQL dump unless db.sha256 still stays. Extra Show stays passwordless. 2.1.172 checks listed db size on a bound restore even without db.sha256. Extra Show stays passwordless. 2.1.171 refuses a bound restore that lists db.sha256 unless hash_check still stays. Extra Show stays passwordless. 2.1.170 refuses a 2.1.114 bind when the archive lists file hashes the bind does not cover. Extra Show stays passwordless. 2.1.169 checks listed file hashes on a bound restore even without hash_check. Extra Show stays passwordless. 2.1.168 refuses a restore archive that names this Site ID unless its bind still verifies. Extra Show stays passwordless. 2.1.167 puts a Hub operator password rotate on the eight-try operator password burst before the Hub operator password. Extra Show stays passwordless. 2.1.166 puts a Hub operator Extra enable or disconnect on the eight-try operator billing burst before the Hub operator password. Extra Show stays passwordless. 2.1.165 puts Extra enable or disconnect on the eight-try Extra burst before the Hub password. Extra Show stays passwordless. 2.1.164 puts saving or removing bucket keys on an eight-try bucket burst. Extra Show stays passwordless. 2.1.163 puts a Cloudflare token save or disconnect on an eight-try Cloud token burst. Extra Show stays passwordless. 2.1.162 puts a Site key rotate on an eight-try rotate burst. Extra Show stays passwordless. 2.1.161 puts a Site disconnect on an eight-try disconnect burst. Extra Show stays passwordless. 2.1.160 puts signing out one device, other devices, or all devices on an eight-try session burst. Extra Show stays passwordless. 2.1.159 puts a Hub two-factor start, finish, or disable on an eight-try two-factor burst. Extra Show stays passwordless. 2.1.158 puts a plan cancel, resume, switch, or close on an eight-try plan burst. Extra Show stays passwordless. 2.1.157 puts Remove selected sites on the eight-try seat burst. Extra Show stays passwordless. 2.1.156 puts Buy more seats on an eight-try seat burst. Extra Show stays passwordless. 2.1.155 puts GET Cloud bound-zone ruleset refresh on an eight-try Cloud ruleset burst. Extra Show stays passwordless. 2.1.154 lists a Hub Extra refresh from Hub support under Account activity. Extra Show stays passwordless. 2.1.153 lists a Hub Extra enable or disconnect from Hub support under Account activity. Extra Show stays passwordless. 2.1.152 puts a Hub virtual-patch validate on the eight-try virtual-patch burst. Extra Show stays passwordless. 2.1.151 puts a Hub operator password rotate on the eight-try operator password burst. Extra Show stays passwordless. 2.1.150 puts a Hub Extra enable or disconnect on the eight-try Extra burst. Extra Show stays passwordless. 2.1.149 puts a Hub operator billing portal or export on an eight-try operator billing burst. Extra Show stays passwordless. 2.1.148 puts a Hub site rotate or license override on an eight-try operator console burst. Extra Show stays passwordless. 2.1.147 puts a Hub Care claim, start, or complete on an eight-try Care queue burst. Extra Show stays passwordless. 2.1.146 puts a Hub virtual-patch stage, publish, or rollback on an eight-try virtual-patch burst. Extra Show stays passwordless. 2.1.145 puts a Hub support connect or reset email on an eight-try support burst. Extra Show stays passwordless. 2.1.144 treats Extra as available when Extra is configured. Extra Show stays passwordless. 2.1.143 lists a Shield Care cleanup fee under Account activity. Extra Show stays passwordless. 2.1.142 lists a sites, activity, billing, or Care handoff CSV downloaded from Hub support under Account activity. Extra Show stays passwordless. 2.1.141 lists a site suspend, complimentary Pro, or override clear from Hub support under Account activity. Extra Show stays passwordless. 2.1.140 lists a connect or sign-in email from Hub support under Account activity. Extra Show stays passwordless. 2.1.139 lists a Site key rotate, restore, or revoke from Hub support under Account activity. Extra Show stays passwordless. 2.1.138 lists a password reset email under Account activity. Requesting a password reset stays a click. Site keys revoked after a password or 2FA change are listed under Account activity. Extra Show stays passwordless. 2.1.137 lists a Care follow-up note or site details save under Account activity. Saving a Care follow-up note or site details stays a click and refuses a ninth try in 15 minutes. 2.1.136 lists a Care WordPress access save or revoke under Account activity. Saving or removing Care WordPress access stays a click and refuses a ninth try in 15 minutes. 2.1.135 lists a weekly summary or setup reminder change under Account activity. Saving email preferences stays a click and refuses a ninth try in 15 minutes. 2.1.134 lists a Hub sign-in lockout under Account activity. 2.1.133 lists a site label save under Account activity. Saving a site label stays a click and refuses a ninth try in 15 minutes. 2.1.132 lists a billing portal open under Account activity. Opening Manage billing stays a click and refuses a ninth try in 15 minutes. 2.1.131 lists a sites, activity, billing, or Care handoff CSV under Account activity. Export downloads stay a click and refuse a ninth try in 15 minutes. 2.1.130 puts Protect settings save, guided lockdown, admin two-factor, virtual-patch raise, and login tighten on the same eight-try Protect burst. Protect settings save stays a click and refuses a ninth try in 15 minutes. Guided lockdown, admin two-factor, virtual-patch raise, and login tighten stay a click and share the Protect burst. 2.1.129 puts Watch alert settings on the same eight-try Watch burst. Watch alert settings stay a click and refuse a ninth try in 15 minutes. A restore preview is listed under Account activity. Preview restore stays a click and refuses a ninth try in 15 minutes. 2.1.128 lists a Watch URL save, a Watch check, a Watch test, and Watch alert settings under Account activity. Watch URL, Check now, and Send test stay a click and refuse a ninth try in 15 minutes. A backup download stays a click and refuses a ninth try in 15 minutes. Setup reminder changes are listed under Account activity. 2.1.127 lists a Copy now or restore under Account activity. Copy now and restore stay a click and refuse a ninth try in 15 minutes. Turning Extra protection on or off is listed under Account activity. A Site disconnect is listed under Account activity. 2.1.126 lists a backup download under Account activity. Saving or removing bucket keys is listed under Account activity and still needs your Hub password. 2.1.125 lists a Cloudflare token Show under Account activity. Show still needs your Hub password. 2.1.124: The Cloud dashboard no longer lists token zones on a refresh. Load zones stays a click, is listed under Account activity, and refuses a ninth list in 15 minutes. A bound zone name on a site card still shows from the saved bind. 2.1.123 lists a Cloudflare zone list under Account activity and refuses a ninth list in 15 minutes. Listing zones stays a click. The CNAME stub stays a click, is listed under Account activity, and refuses a ninth save or check in 15 minutes. 2.1.122 asks for the Hub password before saving a Cloudflare zone, lists that write under Account activity, and shares the eight-try Cloud firewall burst. 2.1.121 asks for the Hub password before turning Cloud firewall on or off, or disconnecting one site, lists those writes under Account activity, and refuses a ninth change in 15 minutes. Saving a zone stays a click. 2.1.120 asks for the Hub password before saving or disconnecting a Cloudflare token, and lists those writes under Account activity. Show still needs your Hub password. The Hub stores the token locked (AES-GCM). The page shows a mask. Click Show to see it. Click Hide to cover it again. Disconnect removes our rules, then deletes the token. If rules are still on Cloudflare, the Hub keeps the bind and says so. Click Remove rules or Re-sync.

Rules we push: a block on xmlrpc.php, known leftover exploit paths from our rule pack, a bad-bot user-agent block, PHP2Shell follow-up patterns (scanner user-agents, php://filter in the query, a known multipart boundary, PHP_SESSION_UPLOAD_PROGRESS in the query, a p2s.txt path, and short-lived scanner IPs), AI training scrapers (GPTBot, ClaudeBot, Bytespider, Amazonbot, PerplexityBot), a block on public REST user lists at /wp-json/wp/v2/users, and a challenge for empty or script user-agents on wp-login and xmlrpc. Those Cloudflare rules are a pre-PHP layer. They cannot stop the first PHP bug. They do not block normal WordPress admin or media uploads. Body matching is plan-limited and we do not claim it. On a paid Cloudflare plan we also add a login rate limit on wp-login.php. A free Cloudflare plan cannot use that rate-limit phase. Custom WAF rules still go on. The WordPress plugin still rate-limits wp-login. We say that on the Cloud card instead of failing the whole turn-on.

If you edit those rules in the Cloudflare dashboard, Hub shows Rules changed in Cloudflare. We do not overwrite your edits until you click Re-sync.

This is optional. The default product is still the plugin plus this Hub with no DNS change. Open Cloud or Do I need Cloudflare?.