Skip to content
WAF
Visit WAF on GitHub
Set theme to dark (⇧+D)

About Cloudflare Web Application Firewall

The Cloudflare Web Application Firewall (WAF) checks incoming web requests and filters undesired traffic based on sets of rules called rulesets. The matching engine that powers the WAF rules supports the wirefilter syntax, the same syntax used for specifying Firewall Rules.

The WAF includes several Managed Rulesets, provided by Cloudflare, that you can enable and configure.

When you enable these Managed Rulesets, you get immediate protection from a broad set of security rules that are regularly updated. Each of these rules has a default action that varies according to the severity of the rule.

You can override the default action or disable one or more rules included in Managed Rulesets. To customize the rules behavior you define specific configurations or overrides.

You can define a configuration that affects an entire Managed Ruleset, or configure the action and status of one or more rules in the ruleset. Rules have associated tags that allow you to search for a specific group of rules and configure them in bulk.

Additionally, you can create custom rulesets with your own WAF rules that you can later enable or deploy.

Available phases

The Web Application Firewall provides the following phases where you can deploy WAF rules:

  • http_request_firewall_custom
  • http_request_firewall_managed

These phases exist both at the account level and at the zone level. Considering the available phases and the two different levels, the WAF rules are evaluated in the following order:

  1. Rules in the http_request_firewall_custom phase at the account level
  2. Rules in the http_request_firewall_custom phase at the zone level
  3. Rules in the http_request_firewall_managed phase at account level
  4. Rules in the http_request_firewall_managed phase at the zone level

Deploying rulesets to phases

You can deploy the Managed Rulesets provided by WAF to the following phases:

  • http_request_firewall_managed phase at the account level (the phase kind is root)
  • http_request_firewall_managed phase at the zone level (the phase kind is zone)

To deploy your own WAF rules, create a custom ruleset and add any custom rules to this ruleset. Next, deploy the custom ruleset to a supported phase.

You can create and deploy custom rulesets to the http_request_firewall_custom phase at the account level (the phase kind is root).

To learn more about phases, see Phases in the Ruleset Engine documentation.

Get started

To configure Managed Rulesets using the Cloudflare dashboard, check Deploy Managed Rulesets for a zone in the dashboard.

You can also use the Rulesets API to deploy rulesets to the available phases: