[ Web Proxy ]
URL:
Viewing: https://developers.cloudflare.com/waf/tools/zone-lockdown/ [Back]  [Original]
Zone Lockdown Cloudflare Web Application Firewall (WAF) docsSkip to content
[]DirectoryAPISDKsChangelog
SearchCtrlKLog in
WAF
/
  1. Home
  2. /WAF
  3. /Additional tools
  4. /Zone Lockdown

Zone Lockdown

Last updated Aug 14, 2026Copy as MarkdownView as MarkdownAgent setup
OverviewAvailabilityCreate a zone lockdown ruleExample ruleAccess denied exampleRelated resources

Zone Lockdown specifies a list of one or more IP addresses, CIDR ranges, or networks that are the only IPs allowed to access a domain, subdomain, or URL. You can configure multiple destinations, including IPv4/IPv6 addresses, in a single zone lockdown rule.

All IP addresses not specified in the zone lockdown rule will not have access to the specified resources. Requests from those IP addresses will receive an Access Denied response.

Note

Cloudflare recommends that you use custom rules instead of zone lockdown rules to block requests from IP addresses not present in an allowlist of IPs and CIDR ranges.

For examples of using custom rules for this purpose, refer to the following use cases:

Availability

Cloudflare Zone Lockdown is available on paid plans. The Zone lockdown rules option appears only if you have configured at least one zone lockdown rule.

The number of available zone lockdown rules depends on your Cloudflare plan.

Free Pro Business Enterprise
Availability No Yes Yes Yes
Number of rules 0 3 10 200

Create a zone lockdown rule

Note

The Zone lockdown rules option appears only if you have configured at least one zone lockdown rule.

If you have access to Zone Lockdown rules

  1. In the Cloudflare dashboard, go to the Security rules page.

    Go to Security rules ↗

  2. Select Create rule > Zone lockdown rules.
    If this option is not available, refer to the instructions below.

  3. Enter a descriptive name for the rule in Name.

  4. For URLs, enter the domains, subdomains, or URLs you wish to protect from unauthorized IPs. You can use wildcards such as *. Enter one item per line.

  5. For IP Range, enter one or more allowed IPv4/IPv6 addresses or CIDR ranges, one per line. Only these IP addresses and ranges will be able to access the resources you entered in URLs.

  6. (Optional) If you are creating a zone lockdown rule that overlaps with an existing rule, expand Advanced Options and enter a priority for the rule in Priority. The lower the number, the higher the priority. Higher priority rules take precedence.

  7. Select Save and Deploy lockdown rule.

If you do not have access to Zone Lockdown rules

Create a custom rule to perform zone lockdown:

  1. In the Cloudflare dashboard, go to the Security rules page.

    Go to Security rules ↗

  2. Select Templates, and then select the template Allow only specified IP addresses.

  3. Fill in the required fields and select Deploy.

Issue a POST request for the Create a Zone Lockdown rule operation similar to the following:

Required API token permissions

At least one of the following token permissions is required:
  • Firewall Services Write
Create a Zone Lockdown rulebash
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall/lockdowns" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"description": "Block all traffic to staging and wiki unless it comes from HQ or branch offices",
		"urls": [
				"staging.example.com/*",
				"example.com/wiki/*"
		],
		"configurations": [
				{
						"target": "ip_range",
						"value": "192.0.2.0/24"
				},
				{
						"target": "ip_range",
						"value": "2001:DB8::/64"
				},
				{
						"target": "ip",
						"value": "203.0.133.1"
				}
		]
	}'

Example rule

The following example rule will only allow visitors connecting from a companys headquarters or branch offices to access the staging environment and the wiki:

  • Name:

    Block all traffic to staging and wiki unless it comes from HQ or branch offices

  • URLs:

    staging.example.com/*
example.com/wiki/*

  • IP Range:

    192.0.2.0/24
2001:DB8::/64
203.0.133.1

This example would not protect an internal wiki located on a different directory path such as example.com/internal/wiki.

Note

A custom rule with an equivalent behavior would have the following configuration:

Description:
Block all traffic to staging and wiki unless it comes from HQ or branch offices

Expression:

((http.host eq "staging.example.com") or (http.host eq "example.com" and http.request.uri.path wildcard "/wiki/*")) and not ip.src in {192.0.2.0/24 2001:DB8::/64 203.0.133.1}

Action: Block

Access denied example

A visitor from an unauthorized IP will get the following error when there is a match for a zone lockdown rule:

Example of Error 1106 (access denied) received by a user accessing the zone from an unauthorized IP address [Example of Error 1106 (access denied) received by a user accessing the zone from an unauthorized IP address]
PreviousUser Agent BlockingNextBrowser Integrity Check

Was this helpful?

YesNo
Edit pageReport issue

On this page

Edit pageReport issue
Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search
Company
AboutCareersInvestorsPressPress kitGlobal network
Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG
Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse
Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog
Developers
DocumentationLearning centerCommunity
Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform
Start BuildingLog In
2026 Cloudflare, Inc.
Privacy policy| Report security issues| Terms of use| Trademark
privacy options [privacy options]Your privacy choices
[]
Web Proxy Viewer  |  New URL  |  Original Page