Cloudflare Docs
Waf
Cloudflare Docs
WAF
Search icon (depiction of a magnifying glass)
GitHub icon
Visit WAF on GitHub
Set theme to dark (⇧+D)

About Cloudflare Web Application Firewall (WAF)

The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web requests and filters undesired traffic based on sets of rules called rulesets. The matching engine that powers the WAF rules supports the wirefilter syntax using the Rules language .

Managed Rulesets

The Cloudflare WAF includes several Managed Rulesets , provided by Cloudflare, that you can enable and configure.

When you enable these Managed Rulesets, you get immediate protection from a broad set of security rules that are regularly updated. Each of these rules has a default action that varies according to the severity of the rule.

You can override the default action or disable one or more rules included in Managed Rulesets. To customize the rules behavior you define specific configurations or overrides.

You can define a configuration that affects an entire Managed Ruleset, or configure the action and status of one or more rules in the ruleset. Rules have associated tags that allow you to search for a specific group of rules and configure them in bulk.

Custom rulesets

You can create custom rulesets with your own WAF rules that you can later deploy to a phase entry point .

Available phases

The Web Application Firewall provides the following phases where you can deploy WAF rules:

  • http_request_firewall_custom
  • http_request_firewall_managed

These phases exist both at the account level and at the zone level. Considering the available phases and the two different levels, the WAF rules are evaluated in the following order:

  1. Rules in the http_request_firewall_custom phase at the account level
  2. Rules in the http_request_firewall_custom phase at the zone level
  3. Rules in the http_request_firewall_managed phase at account level
  4. Rules in the http_request_firewall_managed phase at the zone level

Deploying rulesets to phases

You can deploy the Managed Rulesets provided by WAF to the following phases:

  • http_request_firewall_managed phase at the account level (the phase kind is root)
  • http_request_firewall_managed phase at the zone level (the phase kind is zone)

To deploy your own WAF rules, create a custom ruleset and add any custom rules to this ruleset. Next, deploy the custom ruleset to a supported phase.

You can create and deploy custom rulesets to the http_request_firewall_custom phase at the account level (the phase kind is root).

To learn more about phases, refer to Phases in the Ruleset Engine documentation.

Rule execution order

Cloudflare evaluates different types of rules when processing incoming requests. The rule execution order is the following:

Next steps

To configure Managed Rulesets using the Cloudflare dashboard, refer to Deploy Managed Rulesets for a zone in the dashboard .

You can also use the Rulesets API to deploy rulesets to the available phases. Refer to the following pages for additional guidance: