# How To Deploy the Cloudflare Managed Ruleset With BetterShield Ultra?

Deploy Cloudflare's managed ruleset from BetterShield Ultra and restore the zone's previous firewall rules when needed.

Deploy Cloudflare's managed ruleset from **[BetterShield Ultra](/ultra/)** and restore the zone's previous firewall rules when needed.

_**Note:** These controls require the paid [BetterShield Ultra](/ultra/) add-on alongside the free BetterShield plugin._

## What it does

**Deploy the managed ruleset** adds Cloudflare's managed ruleset to the connected zone's firewall. It runs after rules that were already there. A connected assistant can propose the same change; see below.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Open the feature

[Connect Cloudflare](/docs/connect-cloudflare/).

<img src="/docs/screenshots/cloudflare-managed-ruleset.png" alt="The Deploy the managed ruleset control in BetterShield Ultra." width="1960" height="334" loading="lazy" decoding="async">

## Step 2: Deploy the Cloudflare managed ruleset

- Open **BetterShield › Ultra › Cloudflare**.
- Under **Deploy the managed ruleset**, press **Deploy it** and confirm.

The control is not deployed by default. After it is applied, the card reads **Deployed from here**. Press **Put the rules back** to restore the rules that existed before Ultra deployed it, including an empty ruleset.

## From a connected assistant

With **Let AI assistants fix things** on, an assistant can propose adding the managed ruleset. It is always a plan you approve, never applied on its own. The plan names the zone and says the ruleset reaches every site on it, sign-in and checkout included, and can stop legitimate requests that look like attacks. It adds the ruleset as one rule and does not rewrite the rules already there. It is refused while a rule of the same kind is on the zone, during a lockdown, in safe mode, on a copy of the site, or without a usable Cloudflare token.

To take it back, ask the assistant to undo it. That is a second plan you approve, and it removes that one rule. It is refused during a lockdown, on a copy or without a usable token, and stays available in safe mode. See [Review change requests from agents](/docs/agent-change-requests/).

## Recommended settings

Review the current Cloudflare firewall configuration first. Deploy during a period when you can test important forms, checkout and API requests.

## What it can break and how to undo

A managed rule can challenge or refuse a legitimate request. Press **Put the rules back** to restore the prior configuration. If WordPress is unavailable, review and change the managed ruleset directly in Cloudflare.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

The control reads **Deployed from here**. Test the site's public forms and integrations. The activity log records the deployment and restoration.

<img src="/docs/screenshots/cloudflare-managed-ruleset.png" alt="The Deploy the managed ruleset control in BetterShield Ultra." width="1960" height="334" loading="lazy" decoding="async">

## On multisite

Only a network administrator can use this control. The ruleset applies to the Cloudflare zone, so it can affect every site served by that zone.

## Related

- [Cloudflare controls](/docs/cloudflare/)
- [Connect Cloudflare](/docs/connect-cloudflare/)
- [Set Cloudflare country rules](/docs/cloudflare-country-rules/)

This is how you can deploy the Cloudflare managed ruleset with BetterShield Ultra.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).