sellSecurity

gpp_good

WAF

Your website's bouncer — it checks every visitor at the door and turns away the bad ones.

OWASP Top 10Common attacks covered

FreeBasic ruleset on all plans

Auto-updatedManaged rules

lightbulb

What is WAF?

WAF stands for Web Application Firewall. It sits in front of your website and inspects every incoming request, blocking the ones that look like attacks while letting normal visitors through.

A traditional firewall blocks based on IP addresses and ports. A WAF is smarter — it understands web traffic, so it can spot tricks hidden inside a request, like someone trying to steal your database contents through a login form.

security

Think of it like…

A nightclub bouncer with a watchlist. Regular guests walk in fine, but anyone matching a known troublemaker pattern gets stopped at the door — no matter how they're dressed up.

help

Why use it?

Websites are constantly probed by automated attacks. The WAF gives you protection against the most common and dangerous ones without you needing to be a security expert.

code_off

SQL injection

Attackers sneak database commands into a form to read or delete your data. WAF spots and blocks these.

script

Cross-site scripting (XSS)

Malicious scripts injected into your pages to hijack visitors' sessions. WAF filters them out.

bug_report

Zero-day exploits

Brand-new vulnerabilities. Cloudflare's managed rules update fast to cover them.

key_off

Stolen credentials

Blocks login attempts that use known leaked username/password pairs.

target

When should you use it?

shopping_cart

Online stores

Anywhere you handle payments or customer data, you want an extra layer of defense.

Sites with logins

api

Public APIs

APIs accept data from anywhere — exactly where WAF rules help most.

trending_up

Growing traffic

The more popular you get, the more bots and attackers find you.

rocket_launch

How to get started

Once your domain is on Cloudflare, the WAF lives under Security in the dashboard. Here's how to turn on protection and write your first custom rule.

Add your site to Cloudflare
Sign up, add your domain, and point your nameservers to Cloudflare so traffic flows through it.
Enable Managed Rules
Go to Security → WAF → Managed rules. Deploy the Cloudflare Managed Ruleset (and the free ruleset on the Free plan) to instantly cover OWASP Top 10 attacks.
Create a custom rule
Go to Security → WAF → Custom rules → Create rule. Build a condition (e.g. block visitors from a country, or requests to /admin) and pick an action like Block or Managed Challenge.
text
```
When incoming requests match:
  (http.request.uri.path contains "/admin")
  and (ip.src.country ne "TW")
Then:
  Action: Block
```
Add a rate limit
Go to Security → WAF → Rate limiting rules to cap how many requests one visitor can send — great against brute-force login attempts. The Free plan includes one rate-limiting rule.
Watch Security Events
Open Security → Events to see what got blocked and why, then fine-tune your rules so real visitors aren't caught by mistake.

school

Key concepts

shield

Managed Rules

Pre-built, auto-updated rule packs maintained by Cloudflare's security team — protection with zero setup.

list_alt

OWASP Core Ruleset

Industry-standard rules using anomaly scoring: each suspicious signal adds points, and the request is blocked once the score crosses a threshold.

tune

Custom Rules

Your own if-this-then-that rules written in Cloudflare's filter expression language.

speed

Rate Limiting

Caps requests per visitor over time to stop floods and brute-force attempts.

psychology

Managed Challenge

Instead of blocking outright, it asks the visitor to prove they're human — bots usually fail.

stacked_line_chart

Attack Score

A machine-learning score (Pro+ plans) rating how likely a request is an attack, even brand-new ones.

tips_and_updates

Tips & billing

lightbulb

Start in Log mode

Set new rules to Log (instead of Block) for a few days first. Watch the events, confirm you're not catching real users, then switch to Block.

The Free plan includes a managed ruleset for high-impact vulnerabilities, basic custom rules, and one rate-limiting rule.
Advanced managed rulesets, attack scoring, and more rate-limiting rules come with Pro, Business, and Enterprise plans.
WAF runs after Cloudflare's DDoS protection, so volumetric floods are already filtered before your rules even see them.
Sensitive Data Detection (flags leaked data like credit card numbers in responses) is an Enterprise feature.