Goal:
Expand an Ubuntu bash installer script so that it configures Cloudflare Firewall rules automatically using the user’s Zone ID and API Token.
The script should support three security levels — Light, Moderate, and Extreme — all using Cloudflare’s free-tier Firewall Rules API.

⸻

🪟 User Inputs (interactive prompt in terminal)
	1.	CLOUDFLARE_EMAIL (optional, only for logging)
	2.	ZONE_ID
	3.	API_TOKEN
	4.	DOMAIN_NAME (used for referer-safe rules)
	5.	SECURITY_LEVEL (choose: light, moderate, or extreme)

⸻

🧰 Dependencies (for a clean Ubuntu install)

sudo apt update
sudo apt install -y curl jq

(jq is for parsing JSON responses and checking rule creation success.)

⸻

🌩️ Cloudflare API Base Endpoint

https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/firewall/rules

Headers:

-H "Authorization: Bearer ${API_TOKEN}" \
-H "Content-Type: application/json"


⸻

🪄 Security Levels

🟢 LIGHT (basic protection, no admin lockdown)
	•	Block /xmlrpc.php
	•	Block /wp-content/ or /wp-includes/ requests not from your domain

Expression:

(http.request.uri.path contains "/xmlrpc.php") or
((http.request.uri.path eq "/wp-content/" or http.request.uri.path eq "/wp-includes/") and not http.referer contains "${DOMAIN_NAME}")


⸻

🟡 MODERATE (adds wp-admin/wp-login limits)
Includes Light rules +
Block access to /wp-login.php or /wp-admin/ (except /wp-admin/admin-ajax.php) from outside AU, US, UK.

Expression:

(
  http.request.uri.path contains "/wp-login.php" or
  (http.request.uri.path contains "/wp-admin/" and http.request.uri.path ne "/wp-admin/admin-ajax.php")
)
and not (ip.geoip.country in {"AU" "US" "UK"})


⸻

🔴 EXTREME (maximum free-tier hardening)
Includes Moderate rules +
Block entire site access from sketchy regions (RU, CN, KP, IR, etc.), except known search engine bots (Googlebot, Bingbot).

Expression:

(
  ip.geoip.country in {"RU" "CN" "KP" "IR" "VN" "TR" "IN" "NG"}
)
and not cf.client.bot


⸻

🧩 Example Bash Logic

Here’s the conceptual structure for your installer:

read -p "Enter your Cloudflare Zone ID: " ZONE_ID
read -p "Enter your Cloudflare API Token: " API_TOKEN
read -p "Enter your domain (e.g. example.com): " DOMAIN
read -p "Choose security level (light/moderate/extreme): " LEVEL

API="https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/firewall/rules"

create_rule() {
  local desc="$1"
  local expr="$2"
  echo "Creating rule: $desc..."
  curl -s -X POST "$API" \
    -H "Authorization: Bearer ${API_TOKEN}" \
    -H "Content-Type: application/json" \
    --data "[
      {
        \"description\": \"${desc}\",
        \"action\": \"block\",
        \"filter\": {\"expression\": \"${expr}\"}
      }
    ]" | jq .
}

if [[ "$LEVEL" == "light" || "$LEVEL" == "moderate" || "$LEVEL" == "extreme" ]]; then
  create_rule "Block XMLRPC and unauthorized includes" "(http.request.uri.path contains \"/xmlrpc.php\") or ((http.request.uri.path eq \"/wp-content/\" or http.request.uri.path eq \"/wp-includes/\") and not http.referer contains \"${DOMAIN}\")"
fi

if [[ "$LEVEL" == "moderate" || "$LEVEL" == "extreme" ]]; then
  create_rule "Restrict wp-login/wp-admin to AU, US, UK" "((http.request.uri.path contains \"/wp-login.php\" or (http.request.uri.path contains \"/wp-admin/\" and http.request.uri.path ne \"/wp-admin/admin-ajax.php\")) and not (ip.geoip.country in {\"AU\" \"US\" \"UK\"}))"
fi

if [[ "$LEVEL" == "extreme" ]]; then
  create_rule "Block access from high-risk countries" "((ip.geoip.country in {\"RU\" \"CN\" \"KP\" \"IR\" \"VN\" \"TR\" \"IN\" \"NG\"}) and not cf.client.bot)"
fi

echo "✅ Cloudflare security rules applied for ${DOMAIN} (${LEVEL} mode)"


extra concept to factor in...


💀 “Mega Bot Block” Expansion for Cloudflare Setup Script

This will:
	•	Keep Googlebot, Bingbot, DuckDuckGo, Applebot ✅ allowed.
	•	Block AI scrapers, SEO bots, curl/wget libraries, and other nuisance crawlers.
	•	Skip blocking /robots.txt so legitimate search engines can still fetch it.
	•	Use the same ZONE_ID and API_TOKEN you already input earlier.

⸻

⚙️ Integration Plan

In your Cloudflare bash installer (from before), add a 4th rule group triggered if user enables “bot blocking.”
At the prompt, include:

read -p "Enable advanced bot blocking? (y/n): " BOTBLOCK

If y, it will add a rule called:

“AI Crawl Control - Block AI & SEO Bots”

⸻

💬 Expression (copy-ready for API)

(http.request.uri.path ne "/robots.txt") and (
  (http.user_agent contains "SemrushBot") or
  (http.user_agent contains "AhrefsBot") or
  (http.user_agent contains "Barkrowler") or
  (http.user_agent contains "MJ12bot") or
  (http.user_agent contains "DotBot") or
  (http.user_agent contains "Exabot") or
  (http.user_agent contains "Sogou") or
  (http.user_agent contains "YandexBot") or
  (http.user_agent contains "Baidu") or
  (http.user_agent contains "ia_archiver") or
  (http.user_agent contains "SemanticaBot") or
  (http.user_agent contains "SiteLockSpider") or
  (http.user_agent contains "SeznamBot") or
  (http.user_agent contains "OpenLinkProfiler") or
  (http.user_agent contains "SiteBot") or
  (http.user_agent contains "Screaming Frog") or
  (http.user_agent contains "DataForSeoBot") or
  (http.user_agent contains "SEOkicks") or
  (http.user_agent contains "BLEXBot") or
  (http.user_agent contains "MegaIndex") or
  (http.user_agent contains "MegaIndex.ru") or
  (http.user_agent contains "NetcraftSurveyAgent") or
  (http.user_agent contains "Apache-HttpClient") or
  (http.user_agent contains "Python-urllib") or
  (http.user_agent contains "python-requests") or
  (http.user_agent contains "libwww-perl") or
  (http.user_agent contains "Curl") or
  (http.user_agent contains "wget") or
  (http.user_agent contains "CensysInspect") or
  (http.user_agent contains "ZoominfoBot") or
  (http.user_agent contains "MauiBot") or
  (http.user_agent contains "spbot") or
  (http.user_agent contains "GPTBot") or
  (http.user_agent contains "ClaudeBot") or
  (http.user_agent contains "Claude-SearchBot") or
  (http.user_agent contains "Claude-User") or
  (http.user_agent contains "Bytespider") or
  (http.user_agent contains "MistralAI-User") or
  (http.user_agent contains "Perplexity-User") or
  (http.user_agent contains "ProRataInc") or
  (http.user_agent contains "Novellum") or
  (http.user_agent contains "OAI-SearchBot") or
  (http.user_agent contains "Meta-ExternalFetcher") or
  (http.user_agent contains "Meta-ExternalAgent")
)


⸻

🧠 Add this function into the script

if [[ "$BOTBLOCK" =~ ^[Yy]$ ]]; then
  create_rule "AI Crawl Control - Block AI & SEO Bots" \
  '(http.request.uri.path ne "/robots.txt") and ((http.user_agent contains "SemrushBot") or (http.user_agent contains "AhrefsBot") or (http.user_agent contains "Barkrowler") or (http.user_agent contains "MJ12bot") or (http.user_agent contains "DotBot") or (http.user_agent contains "Exabot") or (http.user_agent contains "Sogou") or (http.user_agent contains "YandexBot") or (http.user_agent contains "Baidu") or (http.user_agent contains "ia_archiver") or (http.user_agent contains "SemanticaBot") or (http.user_agent contains "SiteLockSpider") or (http.user_agent contains "SeznamBot") or (http.user_agent contains "OpenLinkProfiler") or (http.user_agent contains "SiteBot") or (http.user_agent contains "Screaming Frog") or (http.user_agent contains "DataForSeoBot") or (http.user_agent contains "SEOkicks") or (http.user_agent contains "BLEXBot") or (http.user_agent contains "MegaIndex") or (http.user_agent contains "MegaIndex.ru") or (http.user_agent contains "NetcraftSurveyAgent") or (http.user_agent contains "Apache-HttpClient") or (http.user_agent contains "Python-urllib") or (http.user_agent contains "python-requests") or (http.user_agent contains "libwww-perl") or (http.user_agent contains "Curl") or (http.user_agent contains "wget") or (http.user_agent contains "CensysInspect") or (http.user_agent contains "ZoominfoBot") or (http.user_agent contains "MauiBot") or (http.user_agent contains "spbot") or (http.user_agent contains "GPTBot") or (http.user_agent contains "ClaudeBot") or (http.user_agent contains "Claude-SearchBot") or (http.user_agent contains "Claude-User") or (http.user_agent contains "Bytespider") or (http.user_agent contains "MistralAI-User") or (http.user_agent contains "Perplexity-User") or (http.user_agent contains "ProRataInc") or (http.user_agent contains "Novellum") or (http.user_agent contains "OAI-SearchBot") or (http.user_agent contains "Meta-ExternalFetcher") or (http.user_agent contains "Meta-ExternalAgent"))'
fi


⸻

✅ Summary of What This Adds

Rule Type	Action	Notes
/xmlrpc.php & unauthorized includes	Block	Basic protection
wp-login & wp-admin by region	Block	Optional Moderate/Extreme
Country blocks (RU, CN, KP, etc.)	Block	Optional Extreme
Bot/AI/SEO crawler block	Block	Optional, keeps search engines allowed