Cloudflare Add-On 2.5

Version 2.5 is the first Cloudflare Add-On release since 1.3. It focuses on how WP Cerber keeps Cloudflare IP Access Rules synchronized with your current Access Lists and the lockouts the add-on normally mirrors to Cloudflare.

The add-on now rebuilds its existing Cloudflare rule set once after the update, keeps lockout and IP Access List rules separate, handles supported subnet and IPv6 targets correctly, and makes failed Cloudflare operations visible to administrators. If you rely on Cloudflare to mirror WP Cerber decisions at the edge, these changes make that synchronization more predictable and easier to troubleshoot.

Key Highlights

The add-on now requires WP Cerber 9.8.3 or newer and PHP 7.4 or newer.
Existing Cloudflare rules managed by older add-on versions are rebuilt automatically from the current state of WP Cerber.
Lockout rules and IP Access List rules are tracked separately, so one type no longer overwrites or removes the other.
Supported subnet lockouts, wildcard networks such as 192.168.*.*, and single IPv6 addresses are now sent to Cloudflare correctly.
Failed Cloudflare operations can now surface as WordPress admin notices, with the Cloudflare error code preserved when available.

Before updating

Cloudflare Add-On 2.5 requires WP Cerber 9.8.3 or newer and PHP 7.4 or newer. If your website runs an older WP Cerber version, update WP Cerber first and then update the add-on.

The update does not normally require you to recreate existing Cloudflare rules manually. The add-on rebuilds them from the current WP Cerber state.

If you want a detailed record of the rebuild, enable diagnostic logging in the add-on before updating. Rebuild entries are written to the WP Cerber Diagnostic Log only while logging is enabled.

More technical details: What to expect when migrating from older versions

Download the add-on: https://downloads.wpcerber.com/plugin/wp-cerber-cloudflare-addon.zip

Existing Cloudflare rules are rebuilt automatically

Older add-on versions did not always store enough information to determine whether a saved Cloudflare rule belonged to a lockout or to an IP Access List entry. Version 2.5 does not try to infer that ownership from historical records. Instead, it treats the current WP Cerber state as the source of truth.

When the rebuild starts, the add-on reconstructs the Cloudflare rule set for the Allowed IP Access List, the Blocked IP Access List, and active lockouts that it normally synchronizes. The rebuild follows your current add-on settings, so a category with synchronization disabled is not recreated.

No manual action is normally required. The rebuild starts with the next relevant WP Cerber IP event, such as a lockout, an unlock, or a change to an IP Access List. On a quiet website this may not happen immediately. Existing rules remain in Cloudflare until the rebuild begins.

Large rule sets may be rebuilt over several requests rather than all at once. While that is happening, Cloudflare rule IDs and the number of visible rules can change temporarily. WP Cerber continues to enforce its own IP Access Lists and lockouts throughout the process.

Lockout and IP Access List rules stay separate

Previous versions could track different kinds of Cloudflare rules under the same target record. If the same IP address was involved in both an Access List decision and a lockout, one path could interfere with a rule created by the other.

Version 2.5 tracks lockouts, allowed entries, and blocked entries independently. An Access List change no longer risks deleting a Cloudflare rule created for an active lockout, and a lockout no longer causes an Access List rule for the same address to be skipped because another rule record already exists.

Better handling of subnets, wildcard networks, and IPv6

Subnet-wide lockouts now use the same Cloudflare target when a rule is created and when it is later removed. This fixes a case where the block could remain in Cloudflare after the corresponding WP Cerber lockout had ended.

WP Cerber wildcard networks such as 192.168.*.* are now converted to the CIDR form Cloudflare accepts before they are sent. Single IPv6 addresses are also sent with the correct Cloudflare target type.

WP Cerber supports some address and network definitions that Cloudflare IP Access Rules cannot represent. Those entries remain valid and unchanged in WP Cerber. The add-on simply does not mirror an unsupported target to Cloudflare.

Cloudflare API failures are easier to see

When a Cloudflare operation fails during an interactive administrative request, WP Cerber can now show an admin notice with the affected target and the reason returned by Cloudflare. The numeric Cloudflare error code is preserved when available, which makes rejected requests easier to identify in notices and diagnostic logs.

Background activity remains diagnostic-only, so normal visitor traffic does not fill WordPress admin screens with notices. The credentials check also reports the underlying Cloudflare failure reason instead of reducing every failure to the same generic result.

Synchronization handles failures more carefully

A failed database read is no longer interpreted as an empty result. If WP Cerber data cannot be read, the affected synchronization work remains pending instead of being marked complete over missing data.

During the one-time rebuild, an older Cloudflare rule that cannot be deleted remains tracked for another attempt. Individual replacement rules rejected by Cloudflare are reported or logged rather than holding the entire rebuild open, so the final rule set is easier to verify if Cloudflare refuses an operation.

Clearer add-on settings

The settings page now describes more directly what each synchronization option does and which Cloudflare rules it creates. The credentials section also points administrators to the Global API Key and clarifies which Cloudflare account email address belongs with it.

Updating to 2.5

Before updating the add-on, make sure your website runs WP Cerber 9.8.3 or newer and PHP 7.4 or newer. Your Cloudflare email address and Global API Key must also be saved in the add-on settings for the automatic rebuild to start.

More technical details: What to expect when migrating from older versions

After the update, normal synchronization continues and the one-time rebuild begins automatically with the next relevant WP Cerber IP event. If the final Cloudflare rule set does not look as expected, check any administrator notices and the WP Cerber Diagnostic Log if logging was enabled.