Cloudflare Docs
WAF
Cloudflare Docs
WAF
GitHub icon
Visit WAF on GitHub
Set theme to dark (⇧+D)
  1. Products
  2. WAF

Cloudflare Web Application Firewall

Get automatic protection from vulnerabilities and the flexibility to create custom rules.
Available on all plans

​​ Features

​​ Custom rules

Create your own custom rules to protect your website and your APIs from malicious incoming traffic. Use advanced features like WAF attack score and uploaded content scanning in your custom rules.

Use Custom rules

​​ Rate limiting rules

Define rate limits for incoming requests matching an expression, and the action to take when those rate limits are reached.

Use Rate limiting rules

​​ Managed rules

Enable the pre-configured managed rulesets to get immediate protection. These rulesets are regularly updated, offering advanced zero-day vulnerability protections, and you can adjust their behavior.

Use Managed rules

​​ Exposed credential checks

Monitor and block use of stolen/exposed credentials for account takeover.

Use Exposed credential checks

​​ Security Events

Review mitigated requests (rule matches) using an intuitive interface. Tailor your security configurations based on the activity log.

Explore Security Events

​​ Security Analytics

Business and above

Displays information about all incoming HTTP requests, including those not affected by security measures.

Explore Security Analytics

​​ More resources

WAF managed rules (previous version)
Documentation on the previous implementation of WAF managed rules.
Firewall rules
Create rules that inspect incoming traffic and block, challenge, log, or allow specific requests. Use firewall rules if you do not have access to WAF custom rules.