Description

Ensure the Web Application Firewall (WAF) is active for the zone by deploying the Cloudflare Managed Ruleset, which inspects HTTP requests and blocks common attacks such as SQL injection, cross-site scripting, and known exploits. Free plans use the Cloudflare Free Managed Ruleset instead.

Rationale

Web applications are constantly scanned for known vulnerabilities. Without a WAF, every malicious request reaches your origin, and a single unpatched flaw can be exploited. The Cloudflare Managed Ruleset is maintained by Cloudflare and updated as new threats appear, giving strong protection without writing your own rules.

Impact

  • Blocks common web attacks before they reach the origin

  • Rules are updated by Cloudflare as new threats appear

  • Some legitimate requests may need exceptions if they are blocked

Default Value

The Cloudflare Managed Ruleset is not deployed by default and requires a Pro plan or higher. Free plans have the Cloudflare Free Managed Ruleset, which is deployed automatically.

Pre-Requisites

  • Cloudflare account with Administrator or Firewall permissions for the zone

  • Pro, Business, or Enterprise plan for the Cloudflare Managed Ruleset

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Verify that Cloudflare managed ruleset is turned on.

  5. If it is off, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Turn on Cloudflare managed ruleset.

  5. Review Security > Analytics for blocked requests and add exceptions for any false positives.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Turn off Cloudflare managed ruleset.

Reference