Skip to content
Back to Cloud Services

Cloudflare WAF Web Application Firewall

Protect apps from SQLi, XSS, RCE, and OWASP Top 10 with managed rulesets and custom rules at the edge.

CloudflareIntermediate

Why

Cloudflare WAF blocks attacks before they reach origin — 100ms vs 500ms+ for origin-side WAF. Managed rulesets (OWASP, Cloudflare) update daily.

Free plan includes managed rules on Pro+.

When

Enable WAF for any internet-facing app, especially those with forms, login, and DB queries. Tune rules during pen tests and after false-positive reports.

How

1. Enable — dashboard → Security → WAF → Managed rules → enable OWASP + Cloudflare 2. Sensitivity — Low/Medium/High, start Medium, tune based on logs 3. Custom rules — match URI/method/IP/ASN, action: block/challenge/log 4. Rate limit — Security → WAF → Rate limiting rules 5. Deploy — changes apply globally in <30s 6. Monitor — Security Events shows blocked requests, tune false positives 7. Bypass — for specific paths (e.g. /api/webhook) via skip rule

Example

# Custom WAF rule (Terraform) — block SQLi patterns in query string resource "cloudflare_ruleset" "waf_custom" { zone_id = var.zone_id name = "Block SQLi in query" kind = "zone" phase = "http_request_firewall_custom" rules { action = "block" expression = "(http.request.uri.query contains "UNION" and http.request.uri.query contains "SELECT")" description = "Block UNION SELECT SQLi attempts" } } # Rate limit — 100 req/min per IP on /login resource "cloudflare_rate_limit" "login" { zone_id = var.zone_id threshold = 100 period = 60 match { request { url_pattern = "*/login*" } } action { mode = "block" } }

Common Problems

  • ⚠False positives block legit traffic — start with 'log' action, review, then switch to 'block'
  • ⚠Managed rules too broad — disable specific rule IDs causing FPs, not whole ruleset
  • ⚠WAF bypass on /api breaks security — only skip for verified webhook IPs, not all

Best Practices

  • ✓Log before block — run rules in 'log' mode 1 week, analyze false positives
  • ✓Use Cloudflare Ruleset Engine — single declarative config, version-controlled
  • ✓Combine with Bot Fight Mode — blocks automated attacks WAF might miss

FAQ

What is Cloudflare WAF Web Application Firewall and what problem does it solve?

Protect apps from SQLi, XSS, RCE, and OWASP Top 10 with managed rulesets and custom rules at the edge. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Cloudflare WAF Web Application Firewall in 5 minutes?

Two steps to run it: (1) Enable — dashboard → Security → WAF → Managed rules → enable OWASP + Cloudflare; (2) Sensitivity — Low/Medium/High, start Medium, tune based on logs. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Cloudflare WAF Web Application Firewall?

The most frequent issue is: False positives block legit traffic — start with 'log' action, review, then switch to 'block'. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Cloudflare WAF Web Application Firewall?

Best practices for Cloudflare WAF Web Application Firewall include: Log before block — run rules in 'log' mode 1 week, analyze false positives; Use Cloudflare Ruleset Engine — single declarative config, version-controlled; Combine with Bot Fight Mode — blocks automated attacks WAF might miss. The first one — "Log before block — run rules in 'log' mode 1 week, analyze false positives" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Cloudflare WAF Web Application Firewall?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Cloudflare WAF Web Application Firewall options offer a free tier — validate within free quota before scaling.