# Ensure Cloudflare Zone Firewall Rules Use Blocking Actions to Protect Against Threats

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787216867767-ensure-cloudflare-zone-firewall-rules-use-blocking-actions-to-protect-against-threats
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure WAF custom rules that are meant to stop threats use an enforcing action, such as Block, Managed Challenge, JS Challenge, or Interactive Challenge, rather than only Log or Skip. Rules that only log requests do not stop any traffic.

**Rationale**

A custom rule that matches malicious traffic but only logs it gives visibility without protection, so attackers still reach the origin. Log mode is useful for testing, but once a rule is confirmed, it should block or challenge the traffic so that identified threats are actually stopped.

**Impact**

-   Identified threats are actively blocked or challenged
    
-   Custom rules deliver real protection, not just logging
    
-   Rules that are too broad can block legitimate users
    

**Default Value**

By default, no custom rules exist. When you create one, you must choose its action.

**Pre-Requisites**

-   Cloudflare account with Administrator or Firewall permissions for the zone
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Security rules (on older dashboards, Security > WAF).
    
4.  Review the Custom rules and the Action shown for each.
    
5.  If a rule meant to stop threats only uses Log or Skip, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Security rules (on older dashboards, Security > WAF).
    
4.  Select the custom rule to edit it.
    
5.  Under Then take action, choose Block or Managed Challenge.
    
6.  Select Save.
    
7.  Check Security > Analytics to confirm the rule is not blocking legitimate traffic.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Security rules (on older dashboards, Security > WAF).
    
4.  Select the rule, change the action back to its previous value, and select Save.
    

**Reference**

-   [https://developers.cloudflare.com/waf/custom-rules/](https://developers.cloudflare.com/waf/custom-rules/)
    
-   [https://developers.cloudflare.com/ruleset-engine/rules-language/actions/](https://developers.cloudflare.com/ruleset-engine/rules-language/actions/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.