Common policies

The following policies are commonly used to secure HTTP traffic.

Refer to the HTTP policies page for a comprehensive list of other selectors, operators, and actions.

Block sites

Block attempts to reach sites by hostname or URL paths. Different approaches may be required based on how a site is organized.

Block sites by hostname

Block all subdomains that use a host.

Dashboard

Selector	Operator	Value	Action
Host	matches regex	.*example\.com	Block

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Block sites by hostname",
  "description": "Block all subdomains that use a specific hostname",
  "enabled": true,
  "action": "block",
  "filters": [
    "http"
  ],
  "traffic": "http.request.host matches \".*example\\.com\"",
  "identity": "",
  "device_posture": ""
}'

Block sites by URL

Block a section of a site without blocking the entire site. For example, you can block a specific subreddit, such as reddit.com/r/gaming, without blocking reddit.com.

Dashboard

Selector	Operator	Value	Action
URL	matches regex	/r/gaming	Block

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Block sites by URL",
  "description": "Block specific parts of a site without blocking the hostname",
  "enabled": true,
  "action": "block",
  "filters": [
    "http"
  ],
  "traffic": "http.request.uri matches \"/r/gaming\"",
  "identity": "",
  "device_posture": ""
}'

Block content categories

Block content categories which go against your organization's acceptable use policy.

Dashboard

Selector	Operator	Value	Action
Content Categories	in	Adult Themes, Gambling	Block

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Block content categories",
  "description": "Block access to unauthorized adult and gambling applications",
  "enabled": true,
  "action": "block",
  "filters": [
    "http"
  ],
  "traffic": "any(http.request.uri.content_category[*] in {2 67 125 133 99})",
  "identity": "",
  "device_posture": ""
}'

Block unauthorized applications

Note

After seven days, view your shadow IT analytics and block additional applications based on what your users are accessing.

To minimize the risk of shadow IT, some organizations choose to limit their users' access to certain web-based tools and applications. For example, the following policy blocks known AI tools:

Dashboard

Selector	Operator	Value	Action
Application	in	Artificial Intelligence	Block

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Block unauthorized applications",
  "description": "Block access to unauthorized AI applications",
  "enabled": true,
  "action": "block",
  "filters": [
    "http"
  ],
  "traffic": "any(app.type.ids[*] in {25})",
  "identity": "",
  "device_posture": ""
}'

Check user identity

Configure access on a per user or group basis by adding identity-based conditions to your policies.

Dashboard

Selector	Operator	Value	Logic	Action
Application	in	Salesforce	And	Block
User Group Names	in	Contractors

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Check user identity",
  "description": "Block access to Salesforce by temporary employees and contractors",
  "enabled": true,
  "action": "block",
  "filters": [
    "http"
  ],
  "traffic": "any(app.ids[*] in {606})",
  "identity": "any(identity.groups.name[*] in {\"Contractors\"})",
  "device_posture": ""
}'

Skip inspection for groups of applications

Certain client applications, such as Zoom or Apple services, rely on certificate pinning. The TLS decryption performed by Cloudflare Gateway will cause errors when users visit those applications. To avoid this behavior, you must add a Do Not Inspect HTTP policy.

Gateway evaluates Do Not Inspect policies first. We recommend moving your Do Not Inspect policies to the top of the list to reduce confusion.

Dashboard

Selector	Operator	Value	Action
Application	in	Do Not Inspect	Do Not Inspect

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Bypass incompatible applications",
  "description": "Skip TLS decryption for applications that are incompatible with Gateway",
  "enabled": true,
  "action": "off",
  "filters": [
    "http"
  ],
  "traffic": "any(app.type.ids[*] in {16})",
  "identity": "",
  "device_posture": ""
}'

Note

You can select either individual applications or the entire Do Not Inspect set, which will update as new applications are added.

Check device posture

Require devices to have certain software installed or other configuration attributes. For instructions on setting up a device posture check, refer to Enforce device posture.

Enforce a minimum OS version

Perform an OS version check to ensure users are running at least a minimum version.

Dashboard

Selector	Operator	Value	Action
Passed Device Posture Checks	in	Minimum OS version	Allow

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Require OS version",
  "description": "Perform an OS version check for minimum version",
  "enabled": true,
  "action": "allow",
  "filters": [
    "http"
  ],
  "traffic": "",
  "identity": "",
  "device_posture": "any(device_posture.checks.passed[*] in {\"<POSTURE_CHECK_UUID>\"})"
}'

To get the UUIDs of your device posture checks, use the List device posture rules endpoint.

Check for a specific file

Perform a file check to ensure users have a certain file on their device.

Since the file path will be different for each operating system, you can configure a file check for each system and use the Or logical operator to only require one of the checks to pass.

Dashboard

Selector	Operator	Value	Logic	Action
Passed Device Posture Checks	in	macOS File Check	Or	Allow
Passed Device Posture Checks	in	Linux File Check

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Check for specific file",
  "description": "Ensure users have a specific file on their device regardless of operating system",
  "enabled": true,
  "action": "allow",
  "filters": [
    "http"
  ],
  "traffic": "",
  "identity": "",
  "device_posture": "any(device_posture.checks.passed[*] in {\"<POSTURE_CHECK_1_UUID>\"}) or any(device_posture.checks.passed[*] in {\"<POSTURE_CHECK_2_UUID>\"})"
}'

To get the UUIDs of your device posture checks, use the List device posture rules endpoint.

Enforce session duration

Require users to re-authenticate after a certain amount of time has elapsed.

Isolate high risk sites in remote browser

If you are using the Browser Isolation add-on, refer to our list of common Isolate policies.

Bypass inspection for self-signed certificates

When accessing origin servers with certificates not signed by a public certificate authority, you must bypass TLS decryption.

Dashboard

Selector	Operator	Value	Action
Domain	in	internal.example.com	Do Not Inspect

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Bypass internal site inspection",
  "description": "Bypass TLS decryption for internal sites with self-signed certificates",
  "enabled": true,
  "action": "off",
  "filters": [
    "http"
  ],
  "traffic": "any(http.conn.domains[*] in {\"internal.example.com\"})",
  "identity": "",
  "device_posture": ""
}'

Block file types

Block the upload or download of files based on their type.

Dashboard

Selector	Operator	Value	Logic	Action
Upload File Types	in	Microsoft Office Word Document (docx)	And	Block
Download File Types	in	PDF (pdf)

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Block file types",
  "description": "Block the upload or download of files based on their type",
  "enabled": true,
  "action": "block",
  "filters": [
    "http"
  ],
  "traffic": "any(http.upload.file.types[*] in {\"docx\"}) and any(http.download.file.types[*] in {\"pdf\"})",
  "identity": "",
  "device_posture": ""
}'

For more information on supported file types, refer to Download and Upload File Types.

Block Google services

To enable Gateway inspection for Google Drive traffic, you must add a Cloudflare certificate to Google Drive.

Block Google Drive downloads

Block file downloads from Google Drive.

Dashboard

Selector	Operator	Value	Logic	Action
Application	in	Google Drive	And	Block
URL Path & Query	matches regex	.*(e=download|export).*

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Block Google Drive downloads",
  "description": "Block file downloads from Google Drive",
  "enabled": true,
  "action": "block",
  "filters": [
    "http"
  ],
  "traffic": "any(app.ids[*] in {554}) and http.request.uri.path_and_query matches \".*(e=download\\|export).*\"",
  "identity": "",
  "device_posture": ""
}'

Block Gmail downloads

Block file downloads from Gmail.

Dashboard

Selector	Operator	Value	Logic	Action
Host	is	mail-attachment.googleusercontent.com	And	Block
URL Path & Query	is	/attachment/u/0

API

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/gateway/rule \
--header "Content-Type: application/json" \
--header "Authorization: Bearer <API_TOKEN>" \
--data '{
  "name": "Block Gmail downloads",
  "description": "Block file downloads from Gmail",
  "enabled": true,
  "action": "block",
  "filters": [
    "http"
  ],
  "traffic": "http.request.host == \"mail-attachment.googleusercontent.com\" and http.request.uri.path_and_query matches \"/attachment/u/0\"",
  "identity": "",
  "device_posture": ""
}'

Was this helpful?

What did you like?

Accurate

Easy to understand

Solved my problem

Helped me decide to use the product

Other

What went wrong?

Hard to understand

Incorrect information

Missing the information

Other

Thank you for helping improve Cloudflare's documentation!