导航|地址|刷新
Get started
图
Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






WAF

/




Overview

Get started

Concepts


Traffic detections


Overview

Attack score


Leaked credentials


Overview

Get started

Common API calls

Terraform examples

Example mitigation rules






Malicious uploads


Overview

Get started

Example rules

Common API calls

Terraform examples






AI Security for Apps


Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields





Bot score ↗


Threat intelligence


Overview

Get started

Example rules

Available fields










Custom rules


Overview

Create in the dashboard

Create via API

Create using Terraform ↗


Configure a rule with the Skip action


Overview

API examples

Skip options






Common use cases


Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners





Custom rulesets






Rate limiting rules


Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting






Managed rules


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting


Create exceptions


Overview

Add an exception in the dashboard

Add an exception via API






Log the payload of matched rules


Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs


Command-line operations


Overview

Generate a key pair

Decrypt the payload content










Check for exposed credentialsDeprecated


Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection






Rulesets reference


Cloudflare Managed Ruleset


Cloudflare OWASP Core Ruleset


Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗





Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection










Additional tools



Lists


Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions


Lists API


Overview

JSON object

Endpoints










IP Access rules


Overview

Create a rule

Parameters

Actions






Scrape Shield


Overview

Email Address Obfuscation

Hotlink Protection





User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks






Account-level configuration


Overview


Custom rulesets


Overview

Use the dashboard

Use the API

Use Terraform ↗






Rate limiting rulesets


Overview

Create in the dashboard

Create via API

Create using Terraform ↗






Managed rulesets


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗










Analytics


Security Analytics

Security Events





Security features interoperability


Reference


Alerts

Phases


Legacy features



WAF managed rules (previous version)


Overview

Troubleshooting

WAF managed rules upgrade






Rate Limiting (previous version)


Overview

Troubleshooting

Rate limiting upgrade





Firewall rules ↗

Firewall rules upgrade










Troubleshooting


Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ





Glossary


Changelog


Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/WAF

/Get started



Get started


Last updated May 7, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewBefore you begin1. Deploy the Cloudflare Managed Ruleset2. Create custom rule based on WAF attack score3. Configure bot protection Create a custom rule for additional control4. (Optional) Deploy the Cloudflare OWASP Core Ruleset5. Review traffic in security dashboards6. (Optional) Next steps Allowlist certain IP addresses Block specific countries Define rate limits Prevent credential stuffing attacks Prevent users from uploading malware into your applications Get additional security for your APIs Protect your origin server




The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web and API requests and filters undesired traffic based on sets of rules called rulesets.

This page will guide you through the recommended initial steps for configuring the WAF to get immediate protection against the most common attacks.

Refer to Concepts for more information on WAF concepts, main components, and roles.


Note


This guide focuses on configuring WAF for individual domains, known as A zone is a portion of DNS namespace that is managed by a specific organization or administrator.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>zones . The WAF configuration is also available at the account level for Enterprise customers with a paid add-on.








Before you begin



Make sure that you have set up a Cloudflare account and added your domain to Cloudflare.



Users on the Free plan have access to the Cloudflare Free Managed Ruleset, a subset of the Cloudflare Managed Ruleset. The Free Managed Ruleset is deployed by default on Free plans and is not specifically covered in this guide.
If you are on a Free plan, you may skip to 5. Review traffic in security dashboards.



1. Deploy the Cloudflare Managed Ruleset


The Cloudflare Managed Ruleset protects against Common Vulnerabilities and Exposures (CVEs) and known attack vectors. This ruleset is designed to identify common attacks using signatures, while generating low false positives. Rule changes are published on a weekly basis in the WAF changelog. Cloudflare may also add rules at any time during emergency releases for high profile zero-day protection.








In the Cloudflare dashboard, go to the Security Settings page.
Go to Settings ↗


(Optional) Filter by Web application exploits.



Turn on Cloudflare managed ruleset.






Log in to the Cloudflare dashboard ↗, and select your account and domain.

Go to Security > WAF and select the Managed rules tab.

Under Managed Rulesets, select Deploy next to the Cloudflare Managed Ruleset.





Default settings and ruleset customization

By default, the Cloudflare Managed Ruleset enables only a subset of rules and it is designed to strike a balance between protection and false positives. You can review and enable additional rules based on your application technology stack.

In particular situations, enabling the managed ruleset can cause some false positives. False positives are legitimate requests inadvertently mitigated by the WAF. For information on addressing false positives, refer to Troubleshoot managed rules.

If you are testing the WAF against pentesting tools, it is recommended that you enable all rules by using the following ruleset configuration:

Ruleset action: Block

Ruleset status: Enabled (enables all rules in the ruleset)

For more information on configuring the Cloudflare Managed Ruleset in the dashboard, refer to Cloudflare Managed Ruleset.


2. Create custom rule based on WAF attack score



Note


WAF attack score is only available to Business customers (limited access to a single field) and Enterprise customers (full access).



WAF attack score is a machine-learning layer that complements Cloudflare's managed rulesets, providing additional protection against SQL injection ↗ (SQLi), cross-site scripting ↗ (XSS), and many remote code execution ↗ (RCE) attacks. It helps identify rule bypasses and potentially new, undiscovered attacks.

If you are an Enterprise customer, do the following:



Reach out to your account team to get access to WAF attack score.



Create a custom rule using the A number from 1 (likely malicious) to 99 (likely clean) classifying how likely an incoming request is malicious or not. Allows you to detect new attack techniques before they are publicly known.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>Attack Score field:


When incoming requests match:


FieldOperatorValue
WAF Attack Scoreless than20





Choose action: Block




If you are on a Business plan, create a custom rule as mentioned above but use the WAF Attack Score Class field instead. For example, you could use the following rule expression: WAF Attack Score Class equals Attack.


3. Configure bot protection



Note


Bot score is only available to Enterprise customers with Bot Management. Customers on Pro and Business plans should turn on Super Bot Fight Mode instead, which provides built-in bot protection without creating custom rules.



Enterprise customers with Bot Management should first configure bot protection using Security Settings, which provide baseline protection without creating custom rules:



In the Cloudflare dashboard, go to the Security Settings page and filter by Bot traffic.
Go to Settings ↗


Configure the Definitely automated, Likely automated, and Verified bots settings according to your needs.



Turn on Block AI bots if you want to block AI crawlers.



These built-in settings auto-update with new bot signatures and do not count toward your custom rule limits. For more details, refer to Bot Management.


Create a custom rule for additional control


Optionally, if you need more granular control — for example, a different score threshold or rules that combine bot score with other fields — create a custom rule using the A score from 1 to 99 that indicates how likely that request came from a bot, in which 1 to 29 is likely automated and 30 to 99 is likely human.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>Bot Score and A bot or agent that Cloudflare has confirmed is transparent about who it is and what it does: it represents itself honestly and does not abuse the access that honesty earns.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>Verified Bot fields:


When incoming requests match:


FieldOperatorValueLogic
Bot Scoreless than20And
Verified BotequalsOff





Choose action: Managed Challenge


This rule uses a threshold of 20 (instead of the default threshold of 30 used by the settings), providing stricter protection for traffic in the 20-29 score range.

For a more comprehensive example of baseline protection against malicious bots, refer to Challenge bad bots.

For more information about the bot-related fields you can use in expressions, refer to Bot Management variables.

Once you have deployed the Cloudflare Managed Ruleset and rules based on attack score and bot score, you will have achieved substantial protection, limiting the chance of false positives.


4. (Optional) Deploy the Cloudflare OWASP Core Ruleset


After configuring the Cloudflare Managed Ruleset and attack score, you can also deploy the Cloudflare OWASP Core Ruleset. This managed ruleset is Cloudflare's implementation of the OWASP ModSecurity Core Rule Set. Its attack coverage significantly overlaps with Cloudflare Managed Ruleset by detecting common attack vectors such as SQLi and XSS.


Caution


The Cloudflare OWASP Core Ruleset is prone to false positives and offers only marginal benefits when added on top of Cloudflare Managed Ruleset and WAF attack score. If you decide to deploy this managed ruleset, you will need to monitor and adjust its settings based on your traffic to prevent false positives.










In the Cloudflare dashboard, go to the Security Settings page.
Go to Settings ↗


(Optional) Filter by Web application exploits.



Turn on OWASP Core.
This will deploy the Cloudflare OWASP Core Ruleset with the default configuration: paranoia level = PL1 and score threshold = Medium - 40 and higher.






Go to your domain > Security > WAF and select the Managed rules tab.

Under Managed Rulesets, select Deploy next to the Cloudflare OWASP Core Ruleset.
This will deploy the ruleset with the default configuration: paranoia level = PL1 and score threshold = Medium - 40 and higher.





Ruleset configuration

Unlike the signature-based Cloudflare Managed Ruleset, the Cloudflare OWASP Core Ruleset is score-based. You select a certain paranoia level (levels vary from PL1
…(内容过长已截断)

------
导航页 打开网址