导航|地址|刷新
Log mode versus production mode

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






WAF

/




Overview

Get started

Concepts


Traffic detections


Overview

Attack score


Leaked credentials


Overview

Get started

Common API calls

Terraform examples

Example mitigation rules






Malicious uploads


Overview

Get started

Example rules

Common API calls

Terraform examples






AI Security for Apps


Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields





Bot score ↗


Threat intelligence


Overview

Get started

Example rules

Available fields










Custom rules


Overview

Create in the dashboard

Create via API

Create using Terraform ↗


Configure a rule with the Skip action


Overview

API examples

Skip options






Common use cases


Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners





Custom rulesets






Rate limiting rules


Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting






Managed rules


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting


Create exceptions


Overview

Add an exception in the dashboard

Add an exception via API






Log the payload of matched rules


Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs


Command-line operations


Overview

Generate a key pair

Decrypt the payload content










Check for exposed credentialsDeprecated


Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection






Rulesets reference


Cloudflare Managed Ruleset


Cloudflare OWASP Core Ruleset


Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗





Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection










Additional tools



Lists


Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions


Lists API


Overview

JSON object

Endpoints










IP Access rules


Overview

Create a rule

Parameters

Actions






Scrape Shield


Overview

Email Address Obfuscation

Hotlink Protection





User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks






Account-level configuration


Overview


Custom rulesets


Overview

Use the dashboard

Use the API

Use Terraform ↗






Rate limiting rulesets


Overview

Create in the dashboard

Create via API

Create using Terraform ↗






Managed rulesets


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗










Analytics


Security Analytics

Security Events





Security features interoperability


Reference


Alerts

Phases


Legacy features



WAF managed rules (previous version)


Overview

Troubleshooting

WAF managed rules upgrade






Rate Limiting (previous version)


Overview

Troubleshooting

Rate limiting upgrade





Firewall rules ↗

Firewall rules upgrade










Troubleshooting


Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ





Glossary


Changelog


Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/WAF

/…
Traffic detections


/AI Security for Apps

/Log mode vs production mode



Log mode versus production mode


Last updated Apr 16, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewComparisonProduction modeLog mode Enable log modeRecommended workflow




AI Security for Apps can operate in two distinct modes. Understanding the trade-offs between them helps you choose the right approach for your stage of deployment.


Comparison

Feature	Production mode	Log mode
How it works	You write WAF custom rules using AI Security for Apps detection fields	You enable the AI Security Log Mode Ruleset with pre-built rules
Prompt logging	No — only request metadata is logged	Yes — the full request body is logged (encrypted via payload logging)
Response logging	No — use AI Gateway if response visibility is required	No — same limitation
Policy flexibility	Full — combine injection scores, PII categories, bot scores, custom topics, and more	Limited — three fixed rules (PII detected, unsafe topic detected, prompt injection detected) with no score-based or subcategory logic
Blocking behavior	Customizable — issue custom responses including custom JSON	Default WAF block page only
Best for	Production traffic with granular control	Evaluation and testing — correlate prompts with detection results to tune thresholds

Production mode


Production mode is the standard operating mode. You enable AI Security for Apps and create custom rules using the detection fields it populates. This gives you full control over:

Which detections trigger an action. For example, block only when cf.llm.prompt.injection_score is below 30, rather than blocking any detection.

Which PII categories matter. For example, block CREDIT_CARD but only log EMAIL_ADDRESS.

Combining signals. For example, block when both PII is detected and the bot score is low.

Custom responses. Return a JSON error message to your application instead of the default WAF block page.

Example production rule expression:
(cf.llm.prompt.injection_score lt 30 and cf.bot_management.score lt 20)


Limitation


In production mode, the prompt text is not logged. You can see detection metadata (scores, categories) in Security Analytics, but not the actual prompt content.




Log mode


Log mode uses the AI Security Log Mode Ruleset — a pre-built ruleset that logs the full request body alongside detection results. This mode is designed for evaluation and tuning rather than production enforcement.

In log mode:

The managed ruleset fires on three broad conditions: PII detected, unsafe topic detected, and prompt injection detected.

The entire request body is logged using payload logging (encrypted — you must configure a key pair to decrypt payloads).

You can correlate specific prompts with their detection scores to understand how the model classifies your traffic.

When to use log mode:

During initial deployment, to understand what AI Security for Apps detects on your traffic before enforcing actions.

When tuning score thresholds — review logged prompts alongside their scores to determine appropriate thresholds.

When validating that custom topic definitions are working as expected.


Enable log mode









In the Cloudflare dashboard, go to the Security Settings page.
Go to Settings ↗


Under AI Security for Apps, find the Managed Ruleset section.



Enable the AI Security Log Mode Ruleset.



Set the action to Log.



(Recommended) Configure payload logging so you can decrypt and view the full prompt content alongside detection results.





Deploy the managed ruleset using a PUT request:

Required API token permissions
At least one of the following token permissions is required:
Zone WAF Write

Account WAF Write
Update a zone entry point rulesetbashcurl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \ --request PUT \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "rules": [ { "action": "execute", "action_parameters": { "id": "b7cd52df92f74c848cec0c2ed385e336" }, "expression": "true" } ] }'
The ID of the AI Security Log Mode Ruleset is ...d385e336 .

To set individual rule actions to log, override the rules within the managed ruleset using action_parameters.overrides. For more information, refer to Override a managed ruleset.





Caution


Since the managed ruleset uses broad, binary detection logic (detected/not detected), it can be too aggressive for production traffic. Without score-based thresholds, you should expect a higher rate of false positives if the action is set to Block.




Recommended workflow




Start in log mode. Enable the AI Security Log Mode Ruleset with the action set to Log. Configure payload logging so you can view prompts alongside detection results.



Review detections in Security Analytics. Filter on events from the managed ruleset. Decrypt payloads and review the prompts that triggered detections. Note the scores to understand where to set thresholds.



Build production rules. Based on your analysis, create custom rules with appropriate score thresholds and PII category filters.



Disable log mode. Once your production rules are deployed and validated, disable the managed ruleset or keep it on Log as ongoing monitoring.



Monitor and iterate. Continuously review detection events in Security Analytics and adjust thresholds as your traffic patterns evolve.




Note


You can run both modes simultaneously during a transition period. The managed ruleset (log mode) operates in the managed rules phase, while your custom rules operate in the custom rules phase. Custom rules are evaluated before managed rules — if a custom rule blocks a request, it will not reach the managed ruleset. During evaluation, consider setting your custom rules to Log as well.




PreviousExample mitigation rulesNextAvailable fields


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Comparison

Production mode

Log mode

Enable log mode

Recommended workflow


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址