Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.

[]DocsDirectoryAPISDKsChangelog

SearchCtrlK

Log in

WAF

/

• Overview
• Get started
• Concepts
• Traffic detections

  • Overview
  • Attack score
  • Leaked credentials

    • Overview
    • Get started
    • Common API calls
    • Terraform examples
    • Example mitigation rules
  • Malicious uploads

    • Overview
    • Get started
    • Example rules
    • Common API calls
    • Terraform examples
  • AI Security for Apps

    • Overview
    • Get started
    • PII detection
    • Unsafe and custom topic detection
    • Prompt injection detection
    • Token counting
    • Example mitigation rules
    • Log mode vs production mode
    • Available fields
  • Bot score
  • Threat intelligence

    • Overview
    • Get started
    • Example rules
    • Available fields
  • Application Profiles

    • Overview
    • Get started
    • Schema Profiles
    • Analyze profile detections
    • Enforce with Custom Rules
    • Fields
• Custom rules

  • Overview
  • Create in the dashboard
  • Create via API
  • Create using Terraform
  • Configure a rule with the Skip action

    • Overview
    • API examples
    • Skip options
  • Common use cases

    • Allow traffic from IP addresses in allowlist only
    • Allow traffic from search engine bots
    • Allow traffic from specific countries only
    • Block Microsoft Exchange Autodiscover requests
    • Block requests by attack score
    • Block traffic by geographical location
    • Block traffic from specific countries
    • Build a sequence rule within custom rules
    • Challenge bad bots
    • Configure token authentication
    • Exempt partners from Hotlink Protection
    • Issue challenge for admin user in JWT claim based on attack score
    • Require a specific cookie
    • Require known IP addresses in site admin area
    • Require specific HTTP headers
    • Require specific HTTP ports
    • Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
    • Update custom rules for customers or partners
  • Custom rulesets
• Rate limiting rules

  • Overview
  • Request rate calculation
  • Create in the dashboard
  • Create via API
  • Create using Terraform
  • Find appropriate rate limit
  • Rate limiting parameters
  • Rule examples
  • Best practices
  • Troubleshooting
• Managed rules

  • Overview
  • Deploy in the dashboard
  • Deploy via API
  • Deploy using Terraform
  • Troubleshooting
  • Create exceptions

    • Overview
    • Add an exception in the dashboard
    • Add an exception via API
  • Log the payload of matched rules

    • Overview
    • Configure in the dashboard
    • View the payload content in the dashboard
    • Configure via API
    • Store decrypted matched payloads in logs
    • Command-line operations

      • Overview
      • Generate a key pair
      • Decrypt the payload content
  • Check for exposed credentialsDeprecated

    • Overview
    • How it works
    • Configure via API
    • Configure using Terraform
    • Test your configuration
    • Monitor exposed credentials events
    • Upgrade to leaked credentials detection
  • Rulesets reference

    • Cloudflare Managed Ruleset
    • Cloudflare OWASP Core Ruleset

      • Overview
      • Concepts
      • Evaluation example
      • Configure in the dashboard
      • Configure via API
      • Configure in Terraform
    • Cloudflare Exposed Credentials Check Managed RulesetDeprecated
    • Cloudflare Sensitive Data Detection
• Additional tools

  • Lists

    • Overview
    • Custom lists
    • Bulk Redirect Lists
    • Managed Lists
    • Create in the dashboard
    • Use lists in expressions
    • Lists API

      • Overview
      • JSON object
      • Endpoints
  • IP Access rules

    • Overview
    • Create a rule
    • Parameters
    • Actions
  • Scrape Shield

    • Overview
    • Email Address Obfuscation
    • Hotlink Protection
  • User Agent Blocking
  • Zone Lockdown
  • Browser Integrity Check
  • Enable security.txt
  • Privacy Pass
  • Replace insecure JS libraries
  • Security Level
  • Validation checks
• Account-level configuration

  • Overview
  • Custom rulesets

    • Overview
    • Use the dashboard
    • Use the API
    • Use Terraform
  • Rate limiting rulesets

    • Overview
    • Create in the dashboard
    • Create via API
    • Create using Terraform
  • Managed rulesets

    • Overview
    • Deploy in the dashboard
    • Deploy via API
    • Deploy using Terraform
    • Create exceptions
• Analytics

  • Security Analytics
  • Security Events
• Security features interoperability
• Reference

  • Alerts
  • Phases
  • Legacy features

    • WAF managed rules (previous version)

      • Overview
      • Troubleshooting
      • WAF managed rules upgrade
    • Rate Limiting (previous version)

      • Overview
      • Troubleshooting
      • Rate limiting upgrade
    • Firewall rules
    • Firewall rules upgrade
• Troubleshooting

  • Bing's Site Scan blocked by a managed rule
  • Fake bot detection blocking legitimate requests
  • Issues sharing to Facebook
  • SameSite cookie interaction with Cloudflare
  • Rule phase interactions
  • FAQ
• Glossary
• Changelog

  • Overview
  • Changelog
  • Scheduled changes
  • Historical (2024)
  • Historical (2023)
  • Historical (2022)
• Agent resources

  • Agent setup
  • Cloudflare Skills
  • Code Mode MCP Server
  • Domain-specific MCP Servers MCP
  • WAF llms.txt
  • WAF llms-full.txt
  • Cloudflare Docs llms.txt
  • Cloudflare Docs llms-full.txt

1. Home
2. /WAF
3. /Additional tools
4. /Scrape Shield

Scrape Shield

Last updated Apr 16, 2026|Copy as Markdown|View as Markdown|Agent setup

Scrape Shield is a collection of settings meant to protect your site's content.

• Email Address Obfuscation
• Hotlink Protection

PreviousActionsNextEmail Address Obfuscation

Was this helpful?

YesNo

Edit pageReport issue

On this page

• Overview

Edit pageReport issue

Getting started

PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search

Company

AboutCareersInvestorsPressPress kitGlobal network

Public interest

Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG

Compliance

Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources

App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers

DocumentationLearning centerCommunity

Solutions

SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

2026 Cloudflare, Inc.

Privacy policy| Report security issues| Terms of use| Trademark

|

[privacy options]Your privacy choices

[]Docs