Skip to main content

WAF - Managed Rule

Cloudflare Managed Rules are a preconfigured set of Web Application Firewall (WAF) rules maintained by Cloudflare.
They are designed to protect your applications against the most common vulnerabilities and attack patterns — without requiring you to manually build every rule.

These rules are:

  • Continuously updated → Cloudflare’s security team monitors new CVEs and threat intelligence, then updates the rules automatically.
  • Based on OWASP Top 10 → Covering threats like SQL Injection, Cross-Site Scripting (XSS), Local File Inclusion, and other common web exploits.
  • Easy to enable → You can apply them with a few clicks, reducing the need for custom configuration.
  • Customizable → Rules can be fine-tuned or overridden if you need exceptions for your specific application.

Why Managed Rules?​

  • ✅ Save time → No need to research, write, or maintain complex WAF rules manually.
  • ✅ Instant protection → Get coverage against the latest vulnerabilities as soon as Cloudflare updates its rulesets.
  • ✅ Reduce false positives → Pre-tested against real-world traffic patterns.
  • ✅ Layered defense → Combine with your Custom Rules and Rate Limiting for stronger application security.
Example

Think of Managed Rules as Cloudflare’s security “starter pack” — they give you broad protection against known threats out of the box.
You can then add Custom Rules for application-specific needs, and Advanced Rate Limiting for abuse prevention.

Attentions

The directory showing in this section is zone level.

Deploy Cloudflare managed ruleset​

  1. In the Cloudflare Dashboard go to Security ‣ Settings and filter Web application exploits.

  1. Toggle to switch on the Cloudflare managed ruleset.

Go_to_Settings_in_Security

  1. You will be redirected to this pages.

Settings CF managed ruleset

On this screen you can configure:

  1. Execution scope with custom filter expression to apply the ruleset only to a subset of incoming requests.

  2. Set the action to perform (Managed Challenge, Block, JS Challenge, Log, Interactive Challenge, or Default).

  3. Browse and disable specific rules or rules with specific tags

  4. Override the action performed by individual rules or rules with specific tags

  1. For now we will leave everything as default and click Deploy.

Cloudflare managed ruleset

Deploy OWASP Core​

  1. Repeat the same steps to deploy OWASP Core rules.

OWASP core

Settings OWASP core

Checkpoint 1​

  1. After everything done, you will see both ruleset is now enabled.

Security rules

Tips

If you’d like to understand more about the rulesets and their various settings, please see Cloudflare WAF Developers Docs.

Rule verification​

At this point, you have deployed the 2 rulesets which is Cloudflare Managed ruleset and OWASP Core.

  1. Now, lets run some malicious curl command to observe how the Log looks like.
Attention

Please replace the URL below with your own domain name.

for i in {1..50}; \
	do curl -svo /dev/null https://your-domain-name \
	-H "User-agent:Mozlila" 2>&1 | grep "< HTTP"; \
done

For Example:

for i in {1..50}; \
    do curl -svo /dev/null https://uncomplicated-bolt.sxplab.com \
    -H "User-agent:Mozlila" 2>&1 | grep "< HTTP"; \
done
  1. After running the command, you will observe it returns Error 403 HTTP status code. curl command malicious user agent
Tips

Learn more about Error 403 HTTP status code on Cloudflare Docs

  1. Go to Security ‣ Analytics, and browser Events tab, and you will see the Number of Events spike. security events

Checkpoint 2​

  1. We further scroll down and expand to see, these events is actually triggered and blocked by the ruleset that we deployed.

Spend some time looking at the various options you have here. Note how you can see the Service associated with a block.

Scroll down to see more details on the events, note you can see what triggered the rule, the source IP, and so on.

ruleset verification

  1. Finally, expand one of the lines in the Activity Log - This provides even more detail. Note how you can see the Ruleset, and the Specific Rule ID, along with more detailed information on the request. This is very useful for analyzing WAF triggers.

detailed log

👏 Give yourself a big round of applause—you’ve successfully secured your application with Cloudflare managed rules and OWASP Core! 🚀

Key Takeaway​

Managed Rules are Cloudflare’s first line of defense — giving you immediate protection against common web attacks like SQLi, XSS, and other OWASP Top 10 vulnerabilities.

They save you time, are continuously updated by Cloudflare’s security team, and reduce the need to manually maintain complex rules.

⚡ Remember:

  • Managed Rules are broad protection, while Custom Rules are for fine-tuning and application-specific cases.
  • You can override or exclude rules when false positives occur, instead of disabling the entire ruleset.
  • Always monitor the Security Events log after enabling, so you can verify what’s being blocked and adjust actions if needed.
  • Think of them as your baseline shield, and then layer on Custom Rules + Rate Limiting for a complete defense.

📚 Further Reading

  • Configure rules in bulk in a Managed Ruleset
    → Learn how to configure multiple Managed Rules at once. This helps when tuning large deployments or applying consistent changes across your environment.

  • Define exceptions in the dashboard
    → Understand how to create precise exceptions so legitimate traffic isn’t blocked. This is critical when working with APIs, plugins, or admin panels that may trigger false positives.