# Ensure Cloudflare Zone OWASP Managed WAF Rulesets Are Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787217642838-ensure-cloudflare-zone-owasp-managed-waf-rulesets-are-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Cloudflare OWASP Core Ruleset is deployed and turned on for the zone. This managed ruleset is Cloudflare's version of the OWASP ModSecurity Core Rule Set and scores requests for signs of common attacks from the OWASP Top 10.

**Rationale**

The OWASP Top 10 lists the most common and serious web application risks, such as injection and cross-site scripting. The OWASP Core Ruleset adds a second layer of generic attack detection on top of the Cloudflare Managed Ruleset, catching attack patterns even when there is no specific rule for a vulnerability.

**Impact**

-   Adds protection against OWASP Top 10 attacks
    
-   Blocks requests with a high attack score
    
-   May cause false positives at higher paranoia levels, so tune carefully
    

**Default Value**

By default, the OWASP Core Ruleset is not deployed. It is available on Pro, Business, and Enterprise plans, and deploys with paranoia level PL1 and a Medium score threshold.

**Pre-Requisites**

-   Cloudflare account with Administrator or Firewall permissions for the zone
    
-   Pro, Business, or Enterprise plan
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Verify that the OWASP Core Ruleset is turned on.
    
5.  If it is off, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Turn on the Cloudflare OWASP Core Ruleset. It deploys with paranoia level PL1 and a Medium score threshold.
    
5.  Review Security > Analytics for blocked requests, and adjust the score threshold or add exceptions for false positives.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Turn off the Cloudflare OWASP Core Ruleset.
    

**Reference**

-   [https://developers.cloudflare.com/waf/managed-rules/reference/owasp-core-ruleset/](https://developers.cloudflare.com/waf/managed-rules/reference/owasp-core-ruleset/)
    
-   [https://developers.cloudflare.com/waf/get-started/](https://developers.cloudflare.com/waf/get-started/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.