导航|地址|刷新
Custom lists
图
Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






WAF

/




Overview

Get started

Concepts


Traffic detections


Overview

Attack score


Leaked credentials


Overview

Get started

Common API calls

Terraform examples

Example mitigation rules






Malicious uploads


Overview

Get started

Example rules

Common API calls

Terraform examples






AI Security for Apps


Overview

Get started

PII detection

Unsafe and custom topic detection

Prompt injection detection

Token counting

Example mitigation rules

Log mode vs production mode

Available fields





Bot score ↗


Threat intelligence


Overview

Get started

Example rules

Available fields










Custom rules


Overview

Create in the dashboard

Create via API

Create using Terraform ↗


Configure a rule with the Skip action


Overview

API examples

Skip options






Common use cases


Allow traffic from IP addresses in allowlist only

Allow traffic from search engine bots

Allow traffic from specific countries only

Block Microsoft Exchange Autodiscover requests

Block requests by attack score

Block traffic by geographical location

Block traffic from specific countries

Build a sequence rule within custom rules

Challenge bad bots

Configure token authentication

Exempt partners from Hotlink Protection

Issue challenge for admin user in JWT claim based on attack score

Require a specific cookie

Require known IP addresses in site admin area

Require specific HTTP headers

Require specific HTTP ports

Stop R-U-Dead-Yet? (R.U.D.Y.) attacks

Update custom rules for customers or partners





Custom rulesets






Rate limiting rules


Overview

Request rate calculation

Create in the dashboard

Create via API

Create using Terraform ↗

Find appropriate rate limit

Rate limiting parameters

Rule examples

Best practices

Troubleshooting






Managed rules


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Troubleshooting


Create exceptions


Overview

Add an exception in the dashboard

Add an exception via API






Log the payload of matched rules


Overview

Configure in the dashboard

View the payload content in the dashboard

Configure via API

Store decrypted matched payloads in logs


Command-line operations


Overview

Generate a key pair

Decrypt the payload content










Check for exposed credentialsDeprecated


Overview

How it works

Configure via API

Configure using Terraform

Test your configuration

Monitor exposed credentials events

Upgrade to leaked credentials detection






Rulesets reference


Cloudflare Managed Ruleset


Cloudflare OWASP Core Ruleset


Overview

Concepts

Evaluation example

Configure in the dashboard

Configure via API

Configure in Terraform ↗





Cloudflare Exposed Credentials Check Managed RulesetDeprecated

Cloudflare Sensitive Data Detection










Additional tools



Lists


Overview

Custom lists

Bulk Redirect Lists ↗

Managed Lists

Create in the dashboard

Use lists in expressions


Lists API


Overview

JSON object

Endpoints










IP Access rules


Overview

Create a rule

Parameters

Actions






Scrape Shield


Overview

Email Address Obfuscation

Hotlink Protection





User Agent Blocking

Zone Lockdown

Browser Integrity Check

Enable security.txt ↗

Privacy Pass

Replace insecure JS libraries

Security Level

Validation checks






Account-level configuration


Overview


Custom rulesets


Overview

Use the dashboard

Use the API

Use Terraform ↗






Rate limiting rulesets


Overview

Create in the dashboard

Create via API

Create using Terraform ↗






Managed rulesets


Overview

Deploy in the dashboard

Deploy via API

Deploy using Terraform ↗

Create exceptions ↗










Analytics


Security Analytics

Security Events





Security features interoperability


Reference


Alerts

Phases


Legacy features



WAF managed rules (previous version)


Overview

Troubleshooting

WAF managed rules upgrade






Rate Limiting (previous version)


Overview

Troubleshooting

Rate limiting upgrade





Firewall rules ↗

Firewall rules upgrade










Troubleshooting


Bing's Site Scan blocked by a managed rule

Fake bot detection blocking legitimate requests

Issues sharing to Facebook

SameSite cookie interaction with Cloudflare

Rule phase interactions

FAQ





Glossary


Changelog


Overview

Changelog

Scheduled changes

Historical (2024)

Historical (2023)

Historical (2022)






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

WAF llms.txt ↗

WAF llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/WAF

/…
Additional tools


/Lists

/Custom lists



Custom lists


Last updated Apr 16, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewCreate a custom listUse a custom listCustom list types Lists with IP addresses (IP lists)/* ip-lists */ Lists with hostnames Lists with ASNs




A custom list contains one or more items of the same type (for example, IP addresses, hostnames, or ASNs) that you can reference collectively, by name, in rule expressions.

Cloudflare supports the following custom list types:

Lists with IP addresses (also known as IP lists)

Lists with hostnames

Lists with ASNs (autonomous system ↗ numbers)


Note


Lists with hostnames and ASNs are only available to Enterprise customers. Refer to Availability for details.



Each type has its own properties and CSV file format. Refer to the following sections for details.

For more information on lists managed by Cloudflare, such as Managed IP Lists, refer to Managed Lists.


Create a custom list


Refer to Create a list in the dashboard or to the Lists API page.


Use a custom list


Use custom lists in rule expressions with the in operator and with a field supported by the custom list:
<FIELD> in $<LIST_NAME>
The fields you can use vary according to the list item type:


List item typeAvailable fields
IP addressFields with type IP address listed in the Fields reference
Hostnamehttp.host
ASNip.src.asnum



For more information and examples, refer to Use lists in expressions.

------


Custom list types



Lists with IP addresses (IP lists)


List items in custom lists with IP addresses must be in one of the following formats:

Individual IPv4 addresses

Individual IPv6 addresses

IPv4 CIDR ranges with a prefix from /8 to /32

IPv6 CIDR ranges with a prefix from /12 to /128

The same list can contain both individual addresses and CIDR ranges.

You can use uppercase or lowercase characters for IPv6 addresses in lists. However, when you save the list, uppercase characters are converted to lowercase.

CSV file format

When uploading items to a custom list with IP addresses via CSV file, use the following file format (enter one item per line):
<IP_ADDRESS_1>,<DESCRIPTION><IP_ADDRESS_2>
The <DESCRIPTION> field is optional.


Lists with hostnames



Note


Available to Enterprise customers.



List items in custom lists with hostnames must be Fully Qualified Domain Names (FQDNs). An item may contain a * prefix/subdomain wildcard, which must be followed by a . (period). An item cannot include a scheme (for example, https://) or a URL path.

For example, the following entries would be valid for a custom list with hostnames:

example.com

api.example.com

*.example.com

However, example.com/path/subfolder would not be a valid entry.

You can add any valid hostname (a valid FQDN) to a custom list with hostnames. The hostnames do not need to belong to the current Cloudflare account.

CSV file format

When uploading items to a custom list with hostnames via CSV file, use the following file format:
<HOSTNAME_1>,<DESCRIPTION><HOSTNAME_2>
The <DESCRIPTION> field is optional.


Lists with ASNs



Note


Available to Enterprise customers.



List items in custom lists with autonomous system numbers (ASNs) must be integer values.

For example, the following entries would be valid for a list with ASNs:

1

13335

64512

CSV file format

When uploading items to a custom list with ASNs via CSV file, use the following file format:
<ASN_1>,<DESCRIPTION><ASN_2>
The <DESCRIPTION> field is optional.


PreviousOverviewNextBulk Redirect Lists ↗


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Create a custom list

Use a custom list

Custom list types

Lists with IP addresses (IP lists)/* ip-lists */

Lists with hostnames

Lists with ASNs


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址