导航|地址|刷新
Managed Rules

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






WAF

/




Overview

Get started

Concepts


Traffic detections


Overview

Attack score


Leaked credentials


Overview

Get started

Common API calls

Terraform examples

Example mitigation rules






Malicious uploads


Overview

Get started

Example rules

Common API calls

Terraform examples






AI Security for Apps


Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields





Bot score ↗


Threat intelligence


Overview

Get started

Example rules

Available fields










Custom rules


Overview

Create in the dashboard

Create via API

Create using Terraform ↗


Configure a rule with the Skip action


Overview

API examples

Skip options






Common use cases


Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners





Custom rulesets






Rate limiting rules


Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting






Managed rules


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting


Create exceptions


Overview

Add an exception in the dashboard

Add an exception via API






Log the payload of matched rules


Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs


Command-line operations


Overview

Generate a key pair

Decrypt the payload content










Check for exposed credentialsDeprecated


Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection






Rulesets reference


Cloudflare Managed Ruleset


Cloudflare OWASP Core Ruleset


Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗





Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection










Additional tools



Lists


Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions


Lists API


Overview

JSON object

Endpoints










IP Access rules


Overview

Create a rule

Parameters

Actions






Scrape Shield


Overview

Email Address Obfuscation

Hotlink Protection





User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks






Account-level configuration


Overview


Custom rulesets


Overview

Use the dashboard

Use the API

Use Terraform ↗






Rate limiting rulesets


Overview

Create in the dashboard

Create via API

Create using Terraform ↗






Managed rulesets


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗










Analytics


Security Analytics

Security Events





Security features interoperability


Reference


Alerts

Phases


Legacy features



WAF managed rules (previous version)


Overview

Troubleshooting

WAF managed rules upgrade






Rate Limiting (previous version)


Overview

Troubleshooting

Rate limiting upgrade





Firewall rules ↗

Firewall rules upgrade










Troubleshooting


Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ





Glossary


Changelog


Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/WAF

/Managed rules



Managed Rules


Last updated Apr 21, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewAvailable managed rulesetsAvailabilityCustomize the behavior of managed rulesetsInteraction with other app security featuresImportant remarks Maximum body size Zone-level deploymentExecution order WAF exceptions




Cloudflare provides pre-configured managed rulesets that protect against web application exploits such as the following:

Zero-day vulnerabilities

Top-10 attack techniques

Use of stolen/leaked credentials

Extraction of sensitive data

Managed rulesets are regularly updated. Each rule has a default action that varies according to the severity of the rule. You can adjust the behavior of specific rules, choosing from several possible actions.

Rules of managed rulesets have associated tags (such as wordpress) that allow you to search for a specific group of rules and configure them in bulk.


Available managed rulesets



Cloudflare Managed Ruleset: Created by the Cloudflare security team, this ruleset provides fast and effective protection for all of your applications. It covers known attack techniques and zero-day vulnerabilities (newly discovered flaws with no available patch). The ruleset is updated frequently to address new threats and reduce false positives (legitimate requests incorrectly flagged).
Ruleset ID: ...376e9aee



Cloudflare OWASP Core Ruleset: Cloudflare's implementation of the Open Web Application Security Project (OWASP) ModSecurity Core Rule Set. This ruleset uses a scoring model — each matching rule adds its score to a cumulative threat score, and the WAF executes the configured action when the score exceeds the threshold.
Ruleset ID: ...c25d2f1f



Cloudflare Exposed Credentials Check: Deploys an automated credentials check on your end-user authentication endpoints. For any credential pair, the Cloudflare WAF performs a lookup against a public database of stolen credentials to determine if they were previously compromised. Cloudflare recommends that you use leaked credentials detection instead of this ruleset.
Ruleset ID: ...14069605



Cloudflare Free Managed Ruleset: Available on all Cloudflare plans. Provides protection against high-impact and widely exploited vulnerabilities. The rules are safe to deploy on most applications. If you have already deployed the Cloudflare Managed Ruleset, you do not need this ruleset — the Cloudflare Managed Ruleset includes broader coverage.
Ruleset ID: ...dfb893ba


The following managed rulesets run in a response phase:

Cloudflare Sensitive Data Detection: Created by Cloudflare to address common data loss threats. These rules monitor the download of specific sensitive data — for example, financial and personally identifiable information.
Ruleset ID: ...499d988e


Availability


The managed rulesets you can deploy depend on your Cloudflare plan.

	Free	Pro	Business	Enterprise
Availability	Yes	Yes	Yes	Yes
Free Managed Ruleset	Yes	Yes	Yes	Yes
Cloudflare Managed Ruleset	No	Yes	Yes	Yes
Cloudflare OWASP Core Ruleset	No	Yes	Yes	Yes
Cloudflare Exposed Credentials Check (deprecated)	No	Yes	Yes	Yes
Cloudflare Sensitive Data Detection	No	No	No	Yes

Customize the behavior of managed rulesets


To customize the behavior of managed rulesets, do one of the following:

Create exceptions to skip the execution of managed rulesets or some of their rules under certain conditions.

Configure overrides to change the rule action or disable one or more rules of managed rulesets. Overrides can affect an entire managed ruleset, specific tags, or specific rules in the managed ruleset.

Exceptions have priority over overrides.


Important


Ruleset overrides and tag overrides apply to both existing and future rules in the managed ruleset. If you want to override existing rules only, you must use rule overrides.




Interaction with other app security features


If you are using several app security features like custom rules, Managed Rules, and Super Bot Fight Mode, it is important to understand how these features interact and the order in which they execute. Refer to Security features interoperability for more information.


Important remarks



Maximum body size


Managed rules inspect the body of each incoming request up to a maximum size. This limit varies by plan:

For Enterprise customers, the maximum body size is 128 KB.

For other paid plans, the limit is lower by default — contact your account team or Cloudflare Support to increase the limit.

For users in the Free plan, the limit is 1 MB.

Request content beyond this limit may not be fully analyzed, which can affect how managed rules behave. For example, the OWASP Core Ruleset calculates a cumulative threat score based on the scores of individual rules that match a request. Larger payloads give more content for rules to match against, which increases the score and makes it more likely to exceed the score threshold — resulting in a false positive.

If included in your plan, you can use request body fields in custom rules to apply appropriate actions to requests that have not been fully analyzed. The http.request.body.truncated field indicates whether the request body was truncated, while http.request.headers.truncated indicates whether the request contained too many headers for all of them to be included.


Zone-level deployment


At the zone level, you can deploy each managed ruleset once. At the account level, you can deploy each managed ruleset multiple times, which allows you to apply different configurations of the same ruleset to different subsets of incoming traffic.


Execution order


WAF Managed Rules run in the http_request_firewall_managed phase, which executes after:

HTTP DDoS Attack Protection (ddos_l7 phase)

Custom Rules (http_request_firewall_custom phase)

Rate Limiting Rules (http_ratelimit phase)

This means a rule with a terminal action (such as Block or Managed Challenge) in any of these earlier phases prevents Managed Rules from evaluating that request. For the complete security feature execution order, refer to Security features interoperability.


WAF exceptions


WAF exceptions (skip rules) are rules with a skip action deployed to the http_request_firewall_managed phase entry-point ruleset. They are evaluated in list order within the entry-point ruleset — a skip rule only bypasses execute rules listed after it. Place exceptions before the managed ruleset execute rules they are intended to skip. For more information, refer to WAF exceptions.


PreviousTroubleshootingNextDeploy in the dashboard


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Available managed rulesets

Availability

Customize the behavior of managed rulesets

Interaction with other app security features

Important remarks

Maximum body size

Zone-level deployment

Execution order

WAF exceptions


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址