导航|地址|刷新
WAF attack score
图
Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






WAF

/




Overview

Get started

Concepts


Traffic detections


Overview

Attack score


Leaked credentials


Overview

Get started

Common API calls

Terraform examples

Example mitigation rules






Malicious uploads


Overview

Get started

Example rules

Common API calls

Terraform examples






AI Security for Apps


Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields





Bot score ↗


Threat intelligence


Overview

Get started

Example rules

Available fields










Custom rules


Overview

Create in the dashboard

Create via API

Create using Terraform ↗


Configure a rule with the Skip action


Overview

API examples

Skip options






Common use cases


Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners





Custom rulesets






Rate limiting rules


Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting






Managed rules


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting


Create exceptions


Overview

Add an exception in the dashboard

Add an exception via API






Log the payload of matched rules


Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs


Command-line operations


Overview

Generate a key pair

Decrypt the payload content










Check for exposed credentialsDeprecated


Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection






Rulesets reference


Cloudflare Managed Ruleset


Cloudflare OWASP Core Ruleset


Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗





Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection










Additional tools



Lists


Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions


Lists API


Overview

JSON object

Endpoints










IP Access rules


Overview

Create a rule

Parameters

Actions






Scrape Shield


Overview

Email Address Obfuscation

Hotlink Protection





User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks






Account-level configuration


Overview


Custom rulesets


Overview

Use the dashboard

Use the API

Use Terraform ↗






Rate limiting rulesets


Overview

Create in the dashboard

Create via API

Create using Terraform ↗






Managed rulesets


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗










Analytics


Security Analytics

Security Events





Security features interoperability


Reference


Alerts

Phases


Legacy features



WAF managed rules (previous version)


Overview

Troubleshooting

WAF managed rules upgrade






Rate Limiting (previous version)


Overview

Troubleshooting

Rate limiting upgrade





Firewall rules ↗

Firewall rules upgrade










Troubleshooting


Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ





Glossary


Changelog


Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/WAF

/Traffic detections

/Attack score



WAF attack score


Last updated Apr 16, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewAvailable scoresRule recommendationsStart using WAF attack score 1. Create a custom rule 2. Monitor domain traffic 3. Update the rule actionAdditional remarks




The attack score traffic detection classifies each request using a machine learning algorithm, assigning a score from 1 to 99 based on the likelihood that the request is malicious. This detection complements WAF Managed Rules.

Managed Rules match requests against known attack signatures — specific patterns of established attack vectors. They have a very low rate of false positives. However, attackers can modify known payloads, for example by using fuzzing techniques (a testing technique that sends modified inputs to find vulnerabilities), to evade exact signature matches.

Attack score addresses this gap. You can use the score to identify potentially malicious traffic that is not an exact match to any of the rules in WAF Managed Rules.

To maximize protection, Cloudflare recommends that you use both Managed Rules and attack score.


Note


The full feature is available to Enterprise customers. Business plans only have access to a single field (WAF Attack Score Class).




Available scores


The Cloudflare WAF provides the following attack score fields:


FieldDescriptionRequired plan
WAF Attack Score
cf.waf.score
Number		A global score from 1–99 that combines the score of each WAF attack vector into a single score.Enterprise
WAF SQLi Attack Score
cf.waf.score.sqli
Number		A score from 1–99 classifying the SQL injection ↗ (SQLi) attack vector.Enterprise
WAF XSS Attack Score
cf.waf.score.xss
Number		A score from 1–99 classifying the cross-site scripting ↗ (XSS) attack vector.Enterprise
WAF RCE Attack Score
cf.waf.score.rce
Number		A score from 1–99 classifying the command injection or remote code execution ↗ (RCE) attack vector.Enterprise
WAF Attack Score Class
cf.waf.score.class
String		The attack score class of the current request, based on the WAF attack score.
Possible values: attack, likely_attack, likely_clean, and clean.		Business or above



You can use these fields in expressions of custom rules and rate limiting rules. Numeric score fields range from 1 to 99:

A score of 1 indicates that the request is almost certainly malicious.

A score of 99 indicates that the request is likely clean.

A score of 100 means the request reached the WAF attack score system, but the system decided not to score it.

In Logpush data, a score of 0 means the request did not reach the attack score stage — for example, because a previous rule or protection system already mitigated it. The value 0 does not appear in the Cloudflare dashboard.

The global WAF Attack Score is mathematically derived from individual attack scores (for example, from SQLi Attack Score and XSS Attack Score), reflecting their interdependence. However, the global score is not a sum of individual scores. A low global score usually indicates medium to low individual scores, while a high global score suggests higher individual scores.

The WAF Attack Score Class field can have one of the following values, depending on the calculated request attack score:


Dashboard labelField valueDescription
AttackattackAttack score between 1 and 20.
Likely attacklikely_attackAttack score between 21 and 50.
Likely cleanlikely_cleanAttack score between 51 and 80.
CleancleanAttack score between 81 and 99.



Requests with the special attack score 100 will show a WAF Attack Score Class of Unscored in the Cloudflare dashboard, but you cannot use this class value in rule expressions.

Attack score automatically detects and decodes Base64, JavaScript (Unicode escape sequences), and URL encoded content anywhere in the request: URL, headers, and body.


Rule recommendations


Blocking traffic solely based on attack score for all values below 50 is not recommended. The Likely attack range (scores 21–50) can include legitimate requests incorrectly flagged as malicious (false positives). If you want to block traffic based on attack score, do one of the following:


Use a more strict WAF Attack Score value in your expression. For example, block traffic with a WAF attack score below 20 or below 15 (you may need to adjust the exact threshold).



Combine a higher WAF Attack Score threshold with additional filters when blocking incoming traffic. For example, include a check for a specific URI path in your expression or use bot score as part of your criteria.


------


Start using WAF attack score



1. Create a custom rule


Enterprise customers can create a custom rule that blocks requests with a WAF Attack Score less than or equal to 20 (recommended initial threshold). For example:


FieldOperatorValue
WAF Attack Scoreless than or equal to20



Equivalent rule expression: cf.waf.score le 20

Action: Block

Business customers must create a custom rule with the WAF Attack Score Class field instead. For example, use this field to block incoming requests with a score class of Attack:


FieldOperatorValue
WAF Attack Score ClassequalsAttack



Equivalent rule expression: cf.waf.score.class eq "attack"

Action: Block


2. Monitor domain traffic


Monitor the rule you created, especially in the first few days, to make sure you entered an appropriate threshold (or class) for your traffic. Update the rule if required.


3. Update the rule action


If you are an Enterprise customer and you created a rule with Log action, change the rule action to a more severe one, like Managed Challenge or Block.

------


Additional remarks


WAF attack score and bot score serve different purposes. Attack score identifies variations of attacks that WAF Managed Rules do not catch. Bot score identifies whether a request comes from automated traffic.


PreviousOverviewNextOverview


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Available scores

Rule recommendations

Start using WAF attack score

1. Create a custom rule

2. Monitor domain traffic

3. Update the rule action

Additional remarks


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址