Overview
Concepts
WAF attack score
Uploaded content scanning
Get started
Example rules
Common API calls
Custom rules
Create custom rules in the dashboard
Create custom rules via API
Configure a rule with the Skip action
API examples
Skip options
Common use cases
Allow traffic from search engine bots
Allow traffic from specific countries only
Block Microsoft Exchange Autodiscover requests
Block requests by Threat Score
Challenge bad bots
Configure token authentication
Exempt partners from Hotlink Protection
Require a specific cookie
Require known IP addresses in site admin area
Require specific HTTP headers
Require specific HTTP ports
Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
Update custom rules for customers or partners
Custom rulesets
Use the dashboard
Use the API
Rate limiting rules
Request rate calculation
Create in the dashboard for a zone
Create in the dashboard for an account
Create via API
Find appropriate rate limit
Rate limiting parameters
Rule examples
Best practices
Managed rules
Deploy in the dashboard for a zone
Deploy in the dashboard for an account
Deploy via API
Handle false positives
Create exceptions
Add an exception in the dashboard
Add an exception via API
Log the payload of matched rules
Configure payload logging in the dashboard
View the payload content in the dashboard
Configure payload logging via API
Command-line operations
Generate a key pair
Decrypt the payload content
Check for exposed credentials
How it works
Configure via API
Test your configuration
Monitor exposed credentials events
Rulesets reference
Cloudflare Managed Ruleset
Cloudflare OWASP Core Ruleset
Cloudflare Exposed Credentials Check Managed Ruleset
Additional tools
Lists
Custom lists
Bulk Redirect Lists
Managed Lists
Create in the dashboard
Use lists in expressions
Lists API
JSON object
Endpoints
IP Access rules
Create a rule
Parameters
Actions
Scrape Shield
Email Address Obfuscation
Server-side Excludes (SSE)
Hotlink Protection
User Agent Blocking
Zone Lockdown
Browser Integrity Check
Challenge Passage
Privacy Pass
Security Level
Analytics
Security Analytics
Security Events
Free plan
Paid plans
Additional information
Reference
Alerts
Phases
Challenges
Migration guides
WAF Managed Rules migration
Firewall Rules to WAF custom rules migration
Rate limiting (previous version) deprecation
Legacy features
WAF managed rules (previous version)
Troubleshooting
Rate Limiting (previous version)
Troubleshooting
Troubleshooting
Bing's Site Scan blocked by a managed rule
Issues sharing to Facebook
SameSite cookie interaction with Cloudflare
FAQ
Glossary
Changelog
Scheduled changes
2024-03-18
2024-03-11
2024-03-04
2024-02-26
2024-02-20
2024-02-12
2024-02-05
2024-01-22 - Emergency
2024-01-17 - Emergency
2024-01-16
2024-01-04
Historical (2023)
Historical (2022)
Historical (2021)
Historical (2020)
Historical (2019)
Historical (2018)

Scheduled changes

Announcement Date	Release Date	Release Behavior	Legacy Rule ID	Rule ID	Description
2024-04-02	2024-04-08	Block	100632	...49621813	Nginx - File Inclusion
2024-04-02	2024-04-08	Block	100633	...7dc64fb6	PHP - File Inclusion
2024-04-02	2024-04-08	Block	100634	...7eac8439	Generic Database - File Inclusion
2024-04-02	2024-04-08	Block	100635	...a0ccf665	Generic Log - File Inclusion
2024-04-02	2024-04-08	Block	100636	...e485e537	Generic Webservers - File Inclusion
2024-04-02	2024-04-08	Block	100637	...1813c52d	Generic Home Directory - File Inclusion
2024-04-02	2024-04-08	Block	100638	...241fb0cb	Generic System Process - File Inclusion
2024-04-02	2024-04-08	Block	100639	...d03cd48f	Command Injection
2024-04-02	2024-04-08	Block	100640	...e367ad17	Generic System - File Inclusion
2024-04-02	2024-04-08	Block	100641	...a8f03d2d	Apache - File Inclusion