Description
Ensure WAF custom rules that are meant to stop threats use an enforcing action, such as Block, Managed Challenge, JS Challenge, or Interactive Challenge, rather than only Log or Skip. Rules that only log requests do not stop any traffic.
Rationale
A custom rule that matches malicious traffic but only logs it gives visibility without protection, so attackers still reach the origin. Log mode is useful for testing, but once a rule is confirmed, it should block or challenge the traffic so that identified threats are actually stopped.
Impact
Identified threats are actively blocked or challenged
Custom rules deliver real protection, not just logging
Rules that are too broad can block legitimate users
Default Value
By default, no custom rules exist. When you create one, you must choose its action.
Pre-Requisites
Cloudflare account with Administrator or Firewall permissions for the zone
Test Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to Security > Security rules (on older dashboards, Security > WAF).
Review the Custom rules and the Action shown for each.
If a rule meant to stop threats only uses Log or Skip, follow the implementation steps.
Implementation Steps
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to Security > Security rules (on older dashboards, Security > WAF).
Select the custom rule to edit it.
Under Then take action, choose Block or Managed Challenge.
Select Save.
Check Security > Analytics to confirm the rule is not blocking legitimate traffic.
Backout Plan
Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.
Select your account and the domain (zone) you want to review.
Go to Security > Security rules (on older dashboards, Security > WAF).
Select the rule, change the action back to its previous value, and select Save.
Reference