Response firewall

The response firewall applies security rules to HTTP responses. Cloudflare turns on default protections for everyone, on every plan.

You can create response custom rules to block responses or log matches. These rules run in the http_response_firewall_custom phase.

Availability

Every plan includes three response custom rules per zone. All rules count toward this allowance, including disabled rules.

You can include at most one rule with the execute action. An execute rule leaves two slots for block or log rules.

Response custom rules support the following actions:

Action	Behavior
`block`	Block a matching response.
`log`	Log a match.
`execute`	Run the default protections alongside your custom rules.

Response custom rules support the request fields available in WAF custom rules. The same field entitlements apply to response custom rules.

You can also match on the following response fields:

Field	Supported raw variant
`http.response.code`	—
`http.response.content_type.media_type`	—
`http.response.headers`	`raw.http.response.headers`
`http.response.headers.names`	`raw.http.response.headers.names`
`http.response.headers.values`	`raw.http.response.headers.values`
`http.response.set_cookies`	`raw.http.response.set_cookies`

For requests to /api/ paths, this expression matches responses with status code 500:

starts_with(http.request.uri.path, "/api/") and http.response.code eq 500

Response custom rules do not support matching on http.response.body.raw.