> What’s the point of Cloudflare if it can’t even filter out the most basic of brute force Wordpress attacks

Luckily for a one time payment of just $499 the author has a solution at the bottom of the article

They have rate limiting rules but they aren't on by default and are separate from the WAF which is mostly stateless.

here's the solution:

static site generator + cf pages.