导航|地址|刷新
Cloudflare Managed Ruleset

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

WAF

/

Overview

Get started

Concepts

Traffic detections

Overview

Attack score

Leaked credentials

Overview

Get started

Common API calls

Terraform examples

Example mitigation rules

Malicious uploads

Overview

Get started

Example rules

Common API calls

Terraform examples

AI Security for Apps

Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields

Bot score ↗

Threat intelligence

Overview

Get started

Example rules

Available fields

Custom rules

Overview

Create in the dashboard

Create via API

Create using Terraform ↗

Configure a rule with the Skip action

Overview

API examples

Skip options

Common use cases

Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners

Custom rulesets

Rate limiting rules

Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting

Managed rules

Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting

Create exceptions

Overview

Add an exception in the dashboard

Add an exception via API

Log the payload of matched rules

Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs

Command-line operations

Overview

Generate a key pair

Decrypt the payload content

Check for exposed credentialsDeprecated

Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection

Rulesets reference

Cloudflare Managed Ruleset

Cloudflare OWASP Core Ruleset

Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗

Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection

Additional tools

Lists

Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions

Lists API

Overview

JSON object

Endpoints

IP Access rules

Overview

Create a rule

Parameters

Actions

Scrape Shield

Overview

Email Address Obfuscation

Hotlink Protection

User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks

Account-level configuration

Overview

Custom rulesets

Overview

Use the dashboard

Use the API

Use Terraform ↗

Rate limiting rulesets

Overview

Create in the dashboard

Create via API

Create using Terraform ↗

Managed rulesets

Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗

Analytics

Security Analytics

Security Events

Security features interoperability

Reference

Alerts

Phases

Legacy features

WAF managed rules (previous version)

Overview

Troubleshooting

WAF managed rules upgrade

Rate Limiting (previous version)

Overview

Troubleshooting

Rate limiting upgrade

Firewall rules ↗

Firewall rules upgrade

Troubleshooting

Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ

Glossary

Changelog

Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/WAF

/…
Managed rules

/Rulesets reference

/Cloudflare Managed Ruleset

Cloudflare Managed Ruleset

Last updated May 6, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewDeploy the Cloudflare Managed Ruleset/* deploy-in-the-dashboard */Configure in the dashboard Ruleset-level configuration Tag-level configuration Rule-level configurationConfigure via API Example Next steps More resourcesConfigure using Terraform

Created by the Cloudflare security team, this ruleset provides fast and effective protection for all of your applications. The ruleset is updated frequently to cover new vulnerabilities and reduce false positives.

Cloudflare recommends that you enable the rules whose tags correspond to your technology stack. For example, if you use WordPress, enable the rules tagged with wordpress.

Cloudflare's WAF changelog allows you to monitor ongoing changes to the WAF's managed rulesets.

Note

Some rules in the Cloudflare Managed Ruleset are disabled by default, intending to strike a balance between providing the right protection and reducing the number of false positives.

It is not recommended that you enable all the available rules using overrides, since it may affect legitimate traffic, unless you are running a proof of concept (PoC) to understand what kind of requests the WAF can block.

Deploy the Cloudflare Managed Ruleset

In the Cloudflare dashboard, go to the Security Settings page.
Go to Settings ↗

(Optional) Filter by Web application exploits.

Turn on Cloudflare managed ruleset.

Review the deployment settings. Edit the scope, if necessary, to apply the ruleset to a subset of the incoming requests, or configure any custom settings (also known as overrides).

Select Save.

Log in to the Cloudflare dashboard ↗, and select your account and domain.

Go to Security > WAF > Managed rules tab.

Under Managed Rulesets, select Deploy next to Cloudflare Managed Ruleset.

This operation deploys the managed ruleset for the current zone, creating a new rule with the Execute action.

Configure in the dashboard

You can configure (or override) the Cloudflare Managed Ruleset, overriding its default configuration, at several levels:

Ruleset level

Tag level

Rule level

When you create several overrides at different levels, more specific configurations (tag and rule level) have priority over less specific configurations (ruleset level). Refer to Override a managed ruleset in the Ruleset Engine documentation for more information.

Ruleset-level configuration

You can configure (or override) the following Cloudflare Managed Ruleset settings in the Cloudflare dashboard:

Scope: When you define a custom filter expression for the scope, the Cloudflare Managed Ruleset applies only to a subset of the incoming requests. By default, a managed ruleset deployed in the dashboard applies to all incoming traffic.

Ruleset action: When you define an action for the ruleset, you override the default action defined for each rule. The available actions are: Block, Log, Non-Interactive Challenge, Managed Challenge, and Interactive Challenge. To remove the action override at the ruleset level, set the ruleset action to Default.

Ruleset status: Enables or disables all the rules in the ruleset.

Note

When you enable all the rules in the ruleset, you will affect rules that are disabled by default and all the rules that are added to the managed ruleset in the future.

Payload logging: When enabled, logs the request information (payload) that triggered a specific rule of the managed ruleset. You must configure a public key to encrypt the payload.

Once you have deployed the Cloudflare Managed Ruleset, do the following to configure it in the dashboard:

In the Cloudflare dashboard, go to the Security rules page.
Go to Security rules ↗

(Optional) Filter by Managed rules.

Search for Cloudflare Managed Ruleset. Look for a rule with an Execute action.

Select the rule name (containing the name of the managed ruleset) to open the deployment configuration page.

(Optional) To execute the Cloudflare Managed Ruleset for a subset of incoming requests, select Edit scope and configure the expression that will determine the scope of the current rule deploying the managed ruleset.

In the ruleset configuration section, define settings for all the rules in the Cloudflare Managed Ruleset by setting one or more fields using the drop-down lists.

For example, select the action to perform for all the rules in the ruleset.

Select Save.

Log in to the Cloudflare dashboard ↗, and select your account and domain.

Go to Security > WAF > Managed rules tab.

Next to the Execute rule deploying the Cloudflare Managed Ruleset, select the managed ruleset name.
If you have not deployed the managed ruleset yet, select Cloudflare Managed Ruleset under Managed Rulesets.

(Optional) To execute the Cloudflare Managed Ruleset for a subset of incoming requests, select Edit scope and configure the expression that will determine the scope of the current rule deploying the managed ruleset.

Under Ruleset configuration, define settings for all the rules in the Cloudflare Managed Ruleset using the drop-down lists.

For example, select the action to perform for all the rules in the ruleset.

If you have not deployed the Cloudflare Managed Ruleset yet:

Select Deploy to deploy the ruleset immediately.

Select Save as Draft to save your deployment settings for later.

If you are editing a managed ruleset you already deployed, select Save.

Tag-level configuration

You can configure (or override) the following Cloudflare Managed Ruleset settings in the dashboard for rules tagged with at least one of the selected tags:

Rule action: Sets the rule action for all the rules with the selected tags. The available actions are: Block, Log, Non-Interactive Challenge, Managed Challenge, and Interactive Challenge.

Rule status: Sets the rule status for all the rules with the selected tags.

Note

Setting any of these configurations for specific tags affects all current and future rules with the tags you selected.

Once you have deployed the Cloudflare Managed Ruleset, do the following to configure rules with specific tags in the dashboard:

In the Cloudflare dashboard, go to the Security rules page.
Go to Security rules ↗

(Optional) Filter by Managed rules.

Search for Cloudflare Managed Ruleset. Look for a rule with an Execute action.

Select the rule name (containing the name of the managed ruleset), and then select Browse rules.

Select one or more tags under the search input to filter the rules with those tags, and then select the checkbox in the top left corner of the table to select all the rules shown in the current page.
If not all the rules are displayed in the current page, extend your selection to all rules with the selected tags across all pages by selecting Select all <NUMBER> rules.

Update one or more settings for the selected rules using the buttons displayed in the top right corner of the table (for example, Set status).

Select Next.

A dialog appears asking you if any new rules with the selected tags should be configured with the field values you selected.

Select Include new rules if you want to apply your configurations to any new rules with the select tags.

Select Only selected rules to apply your configurations to the selected rules only.

Select Save.

Log in to the Cloudflare dashboard ↗, and select your account and domain.

Go to Security > WAF > Managed rules tab.

If you have already deployed the Cloudflare Managed Ruleset, select the ruleset name in the list of deployed managed rulesets. Alternatively, select the three dots > Edit next to the Execute rule deploying the Cloudflare Managed Ruleset.

If you have not deployed the managed ruleset, select Cloudflare Managed Ruleset under Managed Rulesets.

Select Browse rules.

Select one or more tags under the search input to filter the rules with those tags, and then select the checkbox in the top left corner of the table to select all the rules shown in the current page.
…(内容过长已截断)

------
导航页打开网址