Free, Pro, and Business plans
The DDoS Attack Protection managed rulesets provided by Cloudflare are enabled by default on zones onboarded to Cloudflare, IP applications onboarded to Spectrum, and IP Prefixes onboarded to Magic Transit.
In some situations, the default protection offered by DDoS rules may need to be fine-tuned to your specific situation. You may also want to configure additional protection using other Cloudflare products.
Adjust the provided DDoS rules
If one or more DDoS rules provided by Cloudflare affects legitimate traffic, you can adjust them so that they do not perform any mitigation action against this kind of traffic. Follow the steps in to reduce the sensitivity level of one or more DDoS rules and allow incoming legitimate traffic.
Configure additional protection
Cloudflare’s DDoS protection systems automatically detect and mitigate DDoS attacks. Additionally, the systems may flag suspiciously-looking incoming traffic from legacy applications, Internet services, or faulty client applications as malicious and apply mitigation actions. If the traffic is in fact legitimate, the mitigation actions can cause service disruptions and outages in your Internet properties.
To prevent this situation, Cloudflare recommends that you perform these steps to get started:
- Set the ruleset actions for all the to Log.
- Analyze the flagged traffic.
- Adjust the sensitivity or action of individual managed ruleset rules, if required.
- Switch ruleset actions from Log back to the default.
You must have one of the following:
1. Configure ruleset actions to Log
Alternatively, if you are using the API, define an override at the ruleset level to set the action of all managed ruleset rules to
log by following these instructions:
2. Review flagged traffic
- Go to your (the exact dashboard depends on your Cloudflare services).
- Apply one or more filters, if required, and identify any rules that would have blocked legitimate traffic if Log mode were disabled. Take note of the rule IDs.
3. Customize managed ruleset rules
Customize the specific managed ruleset rules you identified, changing their sensitivity or their action, using the Cloudflare dashboard or using the API.
If you are using the Cloudflare dashboard, refer to:
If you are using the API, refer to:
4. Switch ruleset actions back to the default
Alternatively, if you are using the API, you previously configured at the ruleset level for each managed ruleset. Ensure that you only remove the ruleset override and not any of the rule overrides you may have configured in .