Skip to content

Select theme

WAF

Overview
Get started
Concepts
Traffic detections
- Overview
- Attack score
- Leaked credentials
- Malicious uploads
- Bot score ↗
Custom rules
Rate limiting rules
Managed rules
- Overview
- Deploy in the dashboard
- Deploy via API
- Deploy using Terraform ↗
- Handle false positives
- Create exceptions
- Log the payload of matched rules
  - Overview
  - Configure in the dashboard
  - View the payload content in the dashboard
  - Configure via API
  - Store decrypted matched payloads in logs
  - Command-line operations
    
    Overview
    Generate a key pair
    Decrypt the payload content
- Check for exposed credentials
- Rulesets reference
  - Cloudflare Managed Ruleset
  - Cloudflare OWASP Core Ruleset
    
    Overview
    Concepts
    Evaluation example
    Configure in the dashboard
    Configure via API
    Configure in Terraform ↗
  - Cloudflare Exposed Credentials Check Managed Ruleset
  - Cloudflare Sensitive Data Detection
Additional tools
- Lists
- IP Access rules
- Scrape Shield
- User Agent Blocking
- Zone Lockdown
- Browser Integrity Check
- Challenge Passage
- Enable security.txt ↗
- Privacy Pass
- Replace insecure JS libraries
- Security Level
- Validation checks
Account-level configuration
- Overview
- Custom rulesets
- Rate limiting rulesets
- Managed rulesets
Analytics
- Security Analytics
- Security Events
Reference
- Alerts
- Phases
- Challenges
- Migration guides
- Legacy features
  - WAF managed rules (previous version)
    
    Overview
    Troubleshooting
  - Rate Limiting (previous version)
    
    Overview
    Troubleshooting
Troubleshooting
Glossary
Changelog