Cloudflare Bot Protection Setup and Optimization -- 2

I need Cloudflare configured so my site automatically blocks malicious or nuisance traffic rather than legitimate visitors. The immediate headache is spam-driven form submissions and crawlers hammering the same pages hundreds of times a minute, so the goal is to stop those two behaviours without slowing genuine users.

I already have a Cloudflare account in place; what I’m missing are the right firewall rules, bot management settings, and rate-limiting thresholds. You’ll review my current WAF/Bot Management setup, identify the loopholes that allow automated form posts and excessive page requests, then implement Cloudflare features such as Bot Fight Mode, custom WAF rules, Challenge or Turnstile for forms, and sensible request limits.

Deliverables
• Documented list of rules and settings you add or change, with a one-line purpose for each
• Live testing that proves unwanted traffic is blocked while normal browsing and form use remain unaffected
• A short hand-off note so I can adjust thresholds later if needed

If you have experience tightening Cloudflare against spam bots while keeping page speed intact, I’d like to get this done quickly.