Block application attacks

Web applications face constant threats from SQL injection, Cross-Site Scripting (XSS), and other Open Web Application Security Project (OWASP) Top 10 vulnerabilities. Cloudflare WAF managed rulesets block these attacks automatically, and rate limiting prevents brute force abuse.

Get automatic protection from vulnerabilities and create your own custom rules. Learn more about WAF.

• Managed rulesets - Pre-configured rules covering OWASP Top 10 and emerging threats, updated by Cloudflare
• Zero-day protection - Rules are updated as new vulnerabilities are discovered, with no action required from you
• Custom rules - Block or challenge requests based on any request attribute including headers, cookies, and IP reputation

Limit request rates based on flexible matching criteria. Learn more about rate limiting.

• Rate limiting - Prevent brute force attacks and Application Programming Interface (API) abuse with flexible per-endpoint request limits

1. Deploy WAF managed rulesets
2. Create custom rules
3. Configure rate limiting rules

For custom rules and rate limiting patterns specific to bot traffic, refer to Stop malicious bots while allowing legitimate traffic (Free, Pro, and Business).