Skip to content
Cloudflare Docs
Search
Docs Directory
API & SDKs
Help
Sign up / Log in
GitHub
X
YouTube
Select theme
Dark
Light
Auto
WAF
Overview
Get started
Concepts
Traffic detections
Overview
Attack score
Leaked credentials
Overview
Get started
Common API calls
Mitigation examples
Malicious uploads
Overview
Get started
Example rules
Common API calls
Bot score ↗
Custom rules
Overview
Create in the dashboard
Create via API
Create using Terraform ↗
Configure a rule with the Skip action
Overview
API examples
Skip options
Common use cases
Allow traffic from IP addresses in allowlist only
Allow traffic from search engine bots
Allow traffic from specific countries only
Block Microsoft Exchange Autodiscover requests
Block requests by Threat Score
Block traffic from specific countries
Challenge bad bots
Configure token authentication
Exempt partners from Hotlink Protection
Issue challenge for admin user in JWT claim based on attack score
Require a specific cookie
Require known IP addresses in site admin area
Require specific HTTP headers
Require specific HTTP ports
Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
Update custom rules for customers or partners
Custom rulesets ↗
Rate limiting rules
Overview
Request rate calculation
Create in the dashboard
Create via API
Create using Terraform ↗
Find appropriate rate limit
Rate limiting parameters
Rule examples
Best practices
Managed rules
Overview
Deploy in the dashboard
Deploy via API
Deploy using Terraform ↗
Handle false positives
Create exceptions
Overview
Add an exception in the dashboard
Add an exception via API
Log the payload of matched rules
Overview
Configure in the dashboard
View the payload content in the dashboard
Configure via API
Store decrypted matched payloads in logs
Command-line operations
Overview
Generate a key pair
Decrypt the payload content
Check for exposed credentials
Overview
How it works
Configure via API
Test your configuration
Monitor exposed credentials events
Upgrade to leaked credentials detection
Rulesets reference
Cloudflare Managed Ruleset
Cloudflare OWASP Core Ruleset
Overview
Concepts
Evaluation example
Configure in the dashboard
Configure via API
Configure in Terraform ↗
Cloudflare Exposed Credentials Check Managed Ruleset
Cloudflare Sensitive Data Detection
Additional tools
Lists
Overview
Custom lists
Bulk Redirect Lists ↗
Managed Lists
Create in the dashboard
Use lists in expressions
Lists API
Overview
JSON object
Endpoints
IP Access rules
Overview
Create a rule
Parameters
Actions
Scrape Shield
Overview
Email Address Obfuscation
Hotlink Protection
User Agent Blocking
Zone Lockdown
Browser Integrity Check
Challenge Passage
Enable security.txt ↗
Privacy Pass
Replace insecure JS libraries
Security Level
Validation checks
Account-level configuration
Overview
Custom rulesets
Overview
Use the dashboard
Use the API
Use Terraform ↗
Rate limiting rulesets
Overview
Create in the dashboard
Create via API
Create using Terraform ↗
Managed rulesets
Overview
Deploy in the dashboard
Deploy via API
Deploy using Terraform ↗
Create exceptions ↗
Analytics
Security Analytics
Security Events
Reference
Alerts
Phases
Challenges
Migration guides
WAF Managed Rules migration
Firewall Rules to WAF custom rules migration
Rate limiting (previous version) deprecation
Legacy features
WAF managed rules (previous version)
Overview
Troubleshooting
Rate Limiting (previous version)
Overview
Troubleshooting
Troubleshooting
Bing's Site Scan blocked by a managed rule
Issues sharing to Facebook
SameSite cookie interaction with Cloudflare
FAQ
Glossary
Changelog
Overview
General updates
Scheduled changes
2025-03-03
2025-02-24
2025-02-18
2025-02-11
2025-01-21
2025-01-13
2025-01-06
Historical (2024)
Historical (2023)
Historical (2022)
Historical (2021)
Historical (2020)
Historical (2019)
Historical (2018)
GitHub
X
YouTube
Select theme
Dark
Light
Auto
Products
…
WAF
Additional tools
Scrape Shield
Scrape Shield
Scrape Shield is a collection of settings meant to protect your site's content.
Email Address Obfuscation
Hotlink Protection
Was this helpful?
