I made a free open-source Cloudflare ruleset for WordPress sites:

https://github.com/buybitart/cloudflare-security-art

It helps block scanners, bad requests, and common attack patterns before they reach WordPress. It works with the Cloudflare Free plan.

Feedback is welcome, especially about false positives or missing rules.