导航|地址|刷新
Deploy a custom ruleset

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

Ruleset Engine

/

Overview

About

Overview

Phases

Rulesets

Rules

Basic API operations

View rulesets

Add rules to phase entry point rulesets

Deploy rulesets

Work with managed rulesets

Overview

Deploy a managed ruleset

Override a managed ruleset

Override examples

Overview

Set WordPress rules to Block

Enable only Joomla rules

Enable only selected rules

Deploy a managed ruleset with ruleset, tag, and rule overrides

Adjust the sensitivity of an HTTP DDoS rule to Low

Adjust an L3/4 DDoS rule ↗

Create an exception

Work with custom rulesets

Overview

Create a custom ruleset

Add rules to a custom ruleset

Deploy a custom ruleset

Rules language

Overview

Expressions

Overview

Edit in the dashboard

Operators and grouping symbols

Values

Actions

Fields

Overview

Fields reference

Functions

Rulesets API

Overview

JSON objects

Endpoints

List and view rulesets

Create a ruleset

Update or deploy a ruleset

Add a rule to a ruleset

Update a rule in a ruleset

Delete a rule in a ruleset

Delete a ruleset

Reference

Phases list

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Ruleset Engine llms.txt ↗

Ruleset Engine llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/Ruleset Engine

/Work with custom rulesets

/Deploy a custom ruleset

Deploy a custom ruleset

Last updated Apr 16, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewBefore you beginExample A - Account-level deploymentExample B - Zone-level deployment

To deploy a custom ruleset, add a rule with execute action to the list of rules of a phase entry point ruleset at the account or zone level. The expression of the new rule will define when the custom ruleset will run.

You can only deploy custom rulesets in an entry point ruleset with the same scope. For example, a custom ruleset defined at the account level can only be deployed at the account level.

If you are using Terraform, refer to WAF custom rules configuration using Terraform for examples of creating and deploying custom rulesets.

If you are using the Cloudflare dashboard, refer to Work with custom rulesets in the dashboard.

Note

Currently, zone-level custom rulesets are only available in the http_request_firewall_custom phase.

Before you begin

Obtain the name of the phase where you want to deploy the custom ruleset.

Create a custom ruleset and keep the ID of the new custom ruleset.

Fetch the rules already present in the phase entry point ruleset. You must include in the PUT request all existing rules you want to keep.

Example A - Account-level deployment

The following PUT request adds a rule that executes a custom ruleset when the zone name matches example.com.

In the PUT request, you must include the IDs of all existing rules you want to keep. The response will include all the rules in the phase entry point ruleset after the update.

Required API token permissions
At least one of the following token permissions is required:
Mass URL Redirects Write

Magic Firewall Write

L4 DDoS Managed Ruleset Write

Transform Rules Write

Select Configuration Write

Account WAF Write

Account Rulesets Write

Logs Write
Update an account entry point rulesetbashcurl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/phases/http_request_firewall_custom/entrypoint" \ --request PUT \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "rules": [ { "action": "execute", "description": "Execute custom ruleset", "expression": "(cf.zone.name == \"example.com\") and cf.zone.plan eq \"ENT\"", "action_parameters": { "id": "<CUSTOM_RULESET_ID>" } }, { "id": "<EXISTING_PHASE_RULE_ID_1>" }, { "id": "<EXISTING_PHASE_RULE_ID_2>" } ] }'{ "result": { "id": "<ACCOUNT_PHASE_RULESET_ID>", "name": "http_request_firewall_custom phase entry point ruleset for my account", "description": "Execute several rulesets", "kind": "root", "version": "3", "rules": [ { "id": "<PHASE_RULE_ID>", "version": "1", "action": "execute", "description": "Execute custom ruleset", "action_parameters": { "id": "<CUSTOM_RULESET_ID>", "version": "latest" }, "expression": "(cf.zone.name == \"example.com\") and cf.zone.plan eq \"ENT\"", "last_updated": "2021-03-18T18:35:14.135697Z", "ref": "<PHASE_RULE_REF>", "enabled": true }, { "id": "<EXISTING_PHASE_RULE_ID_1>", "version": "1", "action": "execute", "action_parameters": { "id": "<EXECUTED_RULESET_ID_1>", "version": "latest" }, "expression": "(cf.zone.name eq \"example.com\") and cf.zone.plan eq \"ENT\"", "last_updated": "2021-03-16T15:51:49.180378Z", "ref": "<EXISTING_PHASE_RULE_REF_1>", "enabled": true }, { "id": "<EXISTING_PHASE_RULE_ID_2>", "version": "1", "action": "execute", "action_parameters": { "id": "<EXECUTED_RULESET_ID_2>", "version": "latest" }, "expression": "(cf.zone.name eq \"example.com\") and cf.zone.plan eq \"ENT\"", "last_updated": "2021-03-16T15:50:29.861157Z", "ref": "<EXISTING_PHASE_RULE_REF_2>", "enabled": true } ], "last_updated": "2021-03-18T18:35:14.135697Z", "phase": "http_request_firewall_custom" }, "success": true, "errors": [], "messages": []}

Caution

When deploying the custom ruleset at the account level, you must use parentheses to enclose any custom conditions and end your expression with and cf.zone.plan eq "ENT" like in the example above, or else the API operation will fail.

Example B - Zone-level deployment

The following PUT request adds a rule to a zone-level entry point ruleset that executes a custom ruleset with ID "<CUSTOM_RULESET_ID>" for requests targeting the /login URI path.

You must include in the PUT request the IDs of all existing rules you want to keep. The response will include all the rules in the phase entry point ruleset after the update.

Required API token permissions
At least one of the following token permissions is required:
Response Compression Write

Config Settings Write

Dynamic URL Redirects Write

Cache Settings Write

Custom Errors Write

Origin Write

Managed headers Write

Zone Transform Rules Write

Mass URL Redirects Write

Magic Firewall Write

L4 DDoS Managed Ruleset Write

HTTP DDoS Managed Ruleset Write

Sanitize Write

Transform Rules Write

Select Configuration Write

Bot Management Write

Zone WAF Write

Account WAF Write

Account Rulesets Write

Logs Write

Logs Write
Update a zone entry point rulesetbashcurl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_custom/entrypoint" \ --request PUT \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "rules": [ { "action": "execute", "description": "Execute custom ruleset (zone)", "expression": "(http.request.uri.path eq \"/login\")", "action_parameters": { "id": "<CUSTOM_RULESET_ID>" } }, { "id": "<EXISTING_PHASE_RULE_ID_1>" } ] }'{ "result": { "id": "<ZONE_PHASE_RULESET_ID>", "name": "http_request_firewall_custom phase entry point ruleset for my zone", "description": "", "kind": "zone", "version": "3", "rules": [ { "id": "<PHASE_RULE_ID>", "version": "1", "action": "execute", "description": "Execute custom ruleset (zone)", "action_parameters": { "id": "<CUSTOM_RULESET_ID>", "version": "latest" }, "expression": "(http.request.uri.path eq \"/login\")", "last_updated": "2025-08-18T18:35:14.135697Z", "ref": "<PHASE_RULE_REF>", "enabled": true }, { "id": "<EXISTING_PHASE_RULE_ID_1>", "version": "1", "action": "managed_challenge", "expression": "(cf.waf.score lt 20 and http.request.uri.path wildcard \"/admin/*\")", "last_updated": "2025-08-16T15:51:49.180378Z", "ref": "<EXISTING_PHASE_RULE_REF_1>", "enabled": true } ], "last_updated": "2025-08-18T18:35:14.135697Z", "phase": "http_request_firewall_custom" }, "success": true, "errors": [], "messages": []}

Note

Currently, zone-level custom rulesets are only available in the http_request_firewall_custom phase.

PreviousAdd rules to a custom ruleset NextOverview

Was this helpful?

YesNo

Edit page Report issue

On this page

Overview

Before you begin

Example A - Account-level deployment

Example B - Zone-level deployment

Edit pageReport issue

Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search

Company
AboutCareersInvestorsPressPress kitGlobal network

Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG

Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers
DocumentationLearning centerCommunity

Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices

Docs

------
导航页打开网址