导航|地址|刷新
Lists
图
Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






WAF

/




Overview

Get started

Concepts


Traffic detections


Overview

Attack score


Leaked credentials


Overview

Get started

Common API calls

Terraform examples

Example mitigation rules






Malicious uploads


Overview

Get started

Example rules

Common API calls

Terraform examples






AI Security for Apps


Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields





Bot score ↗


Threat intelligence


Overview

Get started

Example rules

Available fields










Custom rules


Overview

Create in the dashboard

Create via API

Create using Terraform ↗


Configure a rule with the Skip action


Overview

API examples

Skip options






Common use cases


Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners





Custom rulesets






Rate limiting rules


Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting






Managed rules


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting


Create exceptions


Overview

Add an exception in the dashboard

Add an exception via API






Log the payload of matched rules


Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs


Command-line operations


Overview

Generate a key pair

Decrypt the payload content










Check for exposed credentialsDeprecated


Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection






Rulesets reference


Cloudflare Managed Ruleset


Cloudflare OWASP Core Ruleset


Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗





Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection










Additional tools



Lists


Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions


Lists API


Overview

JSON object

Endpoints










IP Access rules


Overview

Create a rule

Parameters

Actions






Scrape Shield


Overview

Email Address Obfuscation

Hotlink Protection





User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks






Account-level configuration


Overview


Custom rulesets


Overview

Use the dashboard

Use the API

Use Terraform ↗






Rate limiting rulesets


Overview

Create in the dashboard

Create via API

Create using Terraform ↗






Managed rulesets


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗










Analytics


Security Analytics

Security Events





Security features interoperability


Reference


Alerts

Phases


Legacy features



WAF managed rules (previous version)


Overview

Troubleshooting

WAF managed rules upgrade






Rate Limiting (previous version)


Overview

Troubleshooting

Rate limiting upgrade





Firewall rules ↗

Firewall rules upgrade










Troubleshooting


Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ





Glossary


Changelog


Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/WAF

/Additional tools

/Lists



Lists


Last updated Apr 16, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewSupported listsList namesWork with lists Create and edit lists Use lists in expressions Search list itemsAvailabilityUser role requirementsFinal remarks




Lists allow you to group items such as IP addresses, hostnames, or autonomous system numbers (ASNs), and reference them by name in Cloudflare rule expressions. Instead of adding each item individually to every rule that needs it, you define the group once and reuse it across rules and zones.

You can create your own custom lists or use Managed Lists maintained by Cloudflare, such as Managed IP Lists that provide threat intelligence data.

Lists have the following advantages:

When creating a rule, using a list is easier and less error-prone than adding a long list of items such as IP addresses to a rule expression.

When updating a set of rules that target the same group of IP addresses (or hostnames), using an IP list (or a hostname list) is easier and less error prone than editing multiple rules.

Lists are easier to read and more informative, particularly when you use descriptive names for your lists.

When you update the content of a list, any rules that use the list are automatically updated, so you can make a single change to your list rather than modify rules individually.

Cloudflare stores your lists at the account level. You can use the same list in rules of different zones in your Cloudflare account.


Supported lists


Cloudflare supports the following lists:

Custom lists: Includes custom IP lists, hostname lists, and ASN lists.

Managed Lists: Lists managed and updated by Cloudflare, such as Managed IP Lists.

Refer to each page for details.


Notes



Bulk Redirects use Bulk Redirect Lists, a different type of list covered in the Rules documentation.



The lists on this page are not the same as Zero Trust lists, which support different data types and have different validation rules (for example, regarding the list name).




You can also use inline lists in rule expressions. Inline lists allow you to include values directly in an expression without creating a separate list first. However, any changes to the values require editing the rule itself.


List names


The name of a list must comply with the following requirements:

The name uses only lowercase letters, numbers, and the underscore (_) character in the name. A valid name satisfies this regular expression: ^[a-z0-9_]+$.

The maximum length of a list name is 50 characters.


Work with lists



Create and edit lists


You can create lists in the Cloudflare dashboard or using the Lists API.

After creating a list, you can add and remove items from the list, but you cannot change the list name or type.


Use lists in expressions


Both the Cloudflare dashboard and the Cloudflare API support lists:

To use lists in an expression from the Cloudflare dashboard, refer to Use lists in expressions.

To reference a list in an API expression, refer to Lists in the Rules language reference.


Caution


Currently, not all Cloudflare products support lists in their expressions. Refer to the documentation of each individual product for details on list support.




Search list items


You can search for list items in the dashboard or via API.

For IP lists, Cloudflare returns IP addresses or ranges that start with your search query. For example, searching 192.0.2 matches 192.0.2.1 and 192.0.2.0/24, but searching for 192.0.2.100 does not match a CIDR stands for Classless Inter-Domain Routing. CIDR often refers to CIDR notation, which is an IP address represented as a series of four 8-bit octets, separated by dots (e.g., 192.168.1.1). Additionally, CIDR notation includes a suffix that indicates the number of bits used for the network portion of the address. The format is typically written as "/X," where X is the number of bits in the network portion.
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>CIDR range like 192.0.2.0/24 that contains that address.

For Bulk Redirect Lists, Cloudflare returns entries where the source URL or target URL contains your search query.


Availability


List availability varies according to the list type and your Cloudflare plan and subscriptions.

FreeProBusinessEnterprise

Availability

Yes

Yes

Yes

Yes

Number of custom lists (any type)

1

10

10

1,000

Max. number of list items (across all custom lists)

10,000

10,000

10,000

500,000

IP lists

Yes

Yes

Yes

Yes

Other custom lists (hostnames, ASNs)

No

No

No

Yes

Managed IP Lists

No

No

No

Yes


Notes:


The number of available custom lists depends on the highest plan in your account. Any account with at least one paid plan will get the highest quota.



Customers on Enterprise plans can create a maximum of 1,000 custom lists in total across different list types. The following additional limits apply:

Up to 40 hostname lists, with a maximum of 10,000 list items across all hostname lists.

Up to 40 ASN lists, with a maximum of 30,000 list items across all ASN lists.



Customers on Enterprise plans may contact their account team if they need more custom lists or a larger maximum number of items across lists.



For details on the availability of Bulk Redirect Lists, refer to the Rules documentation.


------


User role requirements


The following user roles have access to the list management functionality:

Super Administrator

Administrator

Firewall


Final remarks


You can only delete a list when no rules (enabled or disabled) reference it.

Cloudflare will apply the following rules when you add items to an existing list (either manually or via CSV file):

Do not remove any existing list items before updating/adding items.

Update items that were already in the list.

Add items that were not present in the list.

To replace the entire contents of a list at once, format the data as an array and use the Update all list items operation in the Lists API.

The Cloudflare dashboard does not support downloading a list as a CSV file. To export list contents, use the Get list items API operation.


PreviousCloudflare Sensitive Data DetectionNextCustom lists


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Supported lists

List names

Work with lists

Create and edit lists

Use lists in expressions

Search list items

Availability

User role requirements

Final remarks


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址