Deploy a WAF managed ruleset in the dashboard

In the Cloudflare dashboard, go to the Security Settings page.

(Optional) Filter by Web application exploits.

Turn on the managed ruleset(s) you want to deploy:

• Cloudflare managed ruleset - Deploys the Cloudflare Managed Ruleset.
• OWASP Core - Deploys the Cloudflare OWASP Core Ruleset.
• Sensitive data detection - Deploys the Cloudflare Sensitive Data Detection managed ruleset.

Review the deployment settings. Edit the scope, if necessary, to apply the ruleset to a subset of the incoming requests, or configure any custom settings (also known as overrides).

Select Save.

In the Cloudflare dashboard, go to the Security rules page.

(Optional) Filter by Managed rules.

Search for the managed ruleset you want to configure. Look for a rule with an Execute action.

Select the rule name (containing the name of the managed ruleset) to open the deployment configuration page.

(Optional) To execute the managed ruleset for a subset of incoming requests, select Edit scope and configure the expression that will determine the scope of the current rule deploying the managed ruleset.

In the ruleset configuration section, define settings for all the rules in the ruleset by setting one or more fields using the drop-down lists.

For example, select the action to perform for all the rules in the ruleset.

Select Save.

In the Cloudflare dashboard, go to the Security rules page.

(Optional) Filter by Managed rules.

Search for the managed ruleset you want to configure/browse. Look for a rule with an Execute action.

Select the rule name (containing the name of the managed ruleset), and then select Browse rules.

Select one or more tags under the search input to filter the rules with those tags, and then select the checkbox in the top left corner of the table to select all the rules shown in the current page.
If not all the rules are displayed in the current page, extend your selection to all rules with the selected tags across all pages by selecting Select all <NUMBER> rules.

Update one or more settings for the selected rules using the buttons displayed in the top right corner of the table (for example, Set status).

Select Next.

A dialog appears asking you if any new rules with the selected tags should be configured with the field values you selected.

• Select Include new rules if you want to apply your configurations to any new rules with the select tags.
• Select Only selected rules to apply your configurations to the selected rules only.

Select Save.

In the Cloudflare dashboard, go to the Security rules page.

(Optional) Filter by Managed rules.

Search for the managed ruleset you want to configure/browse. Look for a rule with an Execute action.

Select the rule name (containing the name of the managed ruleset), and then select Browse rules.

Search for rules using the available filters.

In the results list, change the values for each rule as desired, using the displayed drop-down lists and toggles. For example, change the status of a rule using the Status toggle next to the rule.

To configure multiple rules with the same value, select the checkboxes for all the rules you want to configure. If not all the rules are displayed in the current page, you can extend your selection to all rules across all pages by selecting Select all <NUMBER> rules. Then, use the buttons displayed in the top right corner of the table for example, Set status to update one or more fields for the selected rules.

Select Next, and then select Save.

In the Cloudflare dashboard, go to the Security rules page.

(Optional) Filter by Managed rules.

Search for the managed ruleset you want to configure.

Next to the managed ruleset deployment rule (execute rule) or exception (skip rule) you want to delete, select the three dots > Delete and confirm the operation.