![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
/
- Overview
- Get started
- Concepts
- Traffic detections
- Overview
- Attack score
- Malicious uploads
- Bot score
- Threat intelligence
- Custom rules
- Overview
- Create in the dashboard
- Create via API
- Create using Terraform
- Configure a rule with the Skip action
- Common use cases
- Allow traffic from IP addresses in allowlist only
- Allow traffic from search engine bots
- Allow traffic from specific countries only
- Block Microsoft Exchange Autodiscover requests
- Block requests by attack score
- Block traffic by geographical location
- Block traffic from specific countries
- Build a sequence rule within custom rules
- Challenge bad bots
- Configure token authentication
- Exempt partners from Hotlink Protection
- Issue challenge for admin user in JWT claim based on attack score
- Require a specific cookie
- Require known IP addresses in site admin area
- Require specific HTTP headers
- Require specific HTTP ports
- Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
- Update custom rules for customers or partners
- Custom rulesets
- Managed rules
- Overview
- Deploy in the dashboard
- Deploy via API
- Deploy using Terraform
- Troubleshooting
- Create exceptions
- Log the payload of matched rules
- Additional tools
- Account-level configuration
- Overview
- Custom rulesets
- Rate limiting rulesets
- Analytics
- Security features interoperability
- Reference
- Alerts
- Phases
- Legacy features
- WAF managed rules (previous version)
- Rate Limiting (previous version)
- Firewall rules
- Firewall rules upgrade
- Glossary
WAF phases
The Web Application Firewall provides the following phases where you can create rulesets and rules:
http_request_firewall_customhttp_ratelimithttp_request_firewall_managed
These phases exist both at the account level and at the zone level. Considering the available phases and the two different levels, rules will be evaluated in the following order:
| Security feature | Scope | Phase | Ruleset kind | Location in the dashboard |
|---|---|---|---|---|
| Custom rulesets |
Account | http_request_firewall_custom |
custom (create)root (deploy) |
Go to WAF ↗ > Custom rulesets tab |
| Custom rules | Zone | http_request_firewall_custom |
zone |
Go to Security rules ↗ |
| Rate limiting rulesets | Account | http_ratelimit |
root |
Go to WAF ↗ > Rate limiting rulesets tab |
| Rate limiting rules | Zone | http_ratelimit |
zone |
Go to Security rules ↗ |
| Managed rulesets | Account | http_request_firewall_managed |
root |
Go to WAF ↗ > Managed rulesets tab |
| Managed rules | Zone | http_request_firewall_managed |
zone |
Go to Security rules ↗ |
To learn more about phases, refer to Phases in the Ruleset Engine documentation.
2026 Cloudflare, Inc.
[privacy options]Your privacy choices
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}