Cloudflare Docs

Cloudflare Docs

Overview
About
Actions
IP Lists
Order and priority
Manage rules in the dashboard
Create, edit, and delete rules
Edit rule expressions
Preview rules
Use IP Lists
Manage lists
Manage IP List items
Use lists in expressions
Create a mTLS rule
Manage rules via the APIs
Firewall Rules API
JSON object
Endpoints
POST example
GET examples
PUT examples
DELETE examples
Cloudflare Filters API
What is a filter?
JSON object
Endpoints
POST example
GET examples
PUT examples
DELETE examples
Expression validation
Rules Lists API
JSON object
Endpoints
Call sequence
Common use cases
Block Microsoft Exchange Autodiscover requests
Block requests based on IP reputation
Challenge bad bots
Exempt partners from Hotlink Protection
Require a specific cookie
Require a valid HMAC token
Require specific HTTP headers
Require specific HTTP ports
Site administration — Require known IP addresses
Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
Update firewall rules for customers or partners
FAQ

Block requests based on IP reputation

A powerful feature of firewall rules is its support for Cloudflare’s IP reputation score. To block requests based on IP reputation, use the cf.threat_score field, which can contain a score from 0 to 100. Reputation scores are collected from Project Honeypot.

This example blocks requests based on country code ( ISO 3166-1 Alpha 2 format), from IP addresses that score greater than 0. This is equivalent to setting the Security Level in Security > Settings to High. For more, refer to Understanding the Cloudflare Security Level.

Expression	Action
`(ip.geoip.country in {"CN" "TW" "US" "GB"}) or cf.threat_score > 0`	Block