Skip to content
Cloudflare Docs

Block requests by attack score

The attack score helps identify variations of known attacks and their malicious payloads.

This example custom rule blocks requests based on country code (ISO 3166-1 Alpha 2 ↗ format), from requests with an attack score lower than 20. For more information, refer to WAF attack score.

  • Expression: (ip.src.country in {"CN" "TW" "US" "GB"} and cf.waf.score lt 20)
  • Action: Block