[ad_1]
[ad_2]
Cloudflare > Security > WAF > Custom Rules: This ruleset covers a lot for WordPress, and you could also add contains "password" & "login" as an extra precaution if you use password protected pages or other login URLs
Sever Firewall Rules: Allow Cloudflare Proxy IPs Only, No Direct IP Access. This forces everyone to use URL/Domain name, and won't allow them to bypass Cloudflare if they have the server IP.
Remember, this is only one of three layers of security. You will need an application-level security for WordPress, like WordFence, to handle anything that gets passed Cloudflare. For me, it's critical to use CF, because they probably have the largest IP pool of bad actors, and will get even stronger with more users pooling bad actor data.
You should be blocking xmlrpc, not challenging.
Why challenge /contact and no other page?