← All products

Web Application Firewall (WAF)

The Cloudflare Web Application Firewall inspects every HTTP request at the edge and blocks exploit attempts — from SQL injection to zero-day CVEs — before they reach your servers.

Overview

Web applications are attacked constantly and automatically: scanners probe for known CVEs, injection flaws, exposed admin panels and leaked credentials within minutes of a vulnerability becoming public. A web application firewall (WAF) filters this traffic in front of the application, buying your team time to patch and stopping the majority of opportunistic exploitation outright.

Cloudflare's WAF runs in every one of its 300+ locations, so filtering happens close to the client with negligible added latency. Rules are maintained by Cloudflare's security research team and updated continuously — often within hours of a major CVE disclosure — without you redeploying anything.

Key capabilities

• Cloudflare Managed Ruleset covering current exploit techniques and high-profile CVEs, updated continuously
• OWASP Core Ruleset with adjustable paranoia level and scoring threshold
• Custom rules built from any request attribute — path, headers, country, ASN, bot score, JA4 fingerprint and more
• Rate limiting rules to throttle brute force, credential stuffing, scraping and API abuse
• Leaked-credentials detection that flags logins using username/password pairs found in public breaches
• Uploaded-content scanning and sensitive-data detection for responses (Enterprise add-ons)
• Attack-score machine learning that rates every request's likelihood of being malicious (Business/Enterprise)
• Full analytics with per-rule matching, and a log-only mode for risk-free rollout

How it works

Every request to your domain terminates at a Cloudflare edge server, where it is evaluated against your WAF configuration in phases: custom rules, rate limiting rules and managed rulesets. Rules are written in Cloudflare's wirefilter expression language and compile to efficient filters, so evaluation adds well under a millisecond in typical configurations.

The managed rulesets are signature- and heuristic-based protections curated by Cloudflare's security team; the OWASP ruleset works differently, scoring each request against dozens of generic attack patterns and blocking when the cumulative score crosses your chosen threshold. On top of this, Cloudflare's ML-based attack score generalises from known payloads, which lets custom rules catch obfuscated variants and previously unseen exploit attempts.

Actions are granular: a rule can block, challenge (interactive or managed), log, or skip other rules — so you can deploy new protections in log-only mode, review matches in analytics, then switch to blocking with confidence.

Plans & licensing

All plans include custom rules and rate limiting in some quantity. The Free plan ships a slim managed ruleset for critical vulnerabilities; Pro adds the full Cloudflare Managed Ruleset and OWASP Core Ruleset; Business raises rule quotas and adds attack-score-based rules; Enterprise adds advanced rate limiting, payload logging, sensitive-data detection and the highest quotas. Details are accurate as of 2026 and subject to change — confirm current packaging with us.

Deployment with Integrity

As a certified Cloudflare partner for Central and Eastern Europe, Integrity delivers this product end to end — including a free pilot so you see results on your own traffic before committing. A typical rollout:

1. Assessment. We inventory your applications, frameworks and known weak points, and review recent attack traffic if you have logs.
2. Free pilot. A proof-of-concept zone goes live with managed rulesets in log-only mode, so we can measure real matches with zero user impact.
3. Baseline configuration. Managed rulesets are enabled in blocking mode with tuned exceptions; custom rules cover your app-specific paths (admin panels, APIs, login endpoints).
4. Rate limiting. Login, checkout and API endpoints get rate limits calibrated from observed traffic.
5. Tuning. Two to four weeks of false-positive review with your team, adjusting exceptions until matches are clean.
6. Handover or managed WAF. Documentation and training for your team, or ongoing rule management by Integrity — including emergency virtual patching when major CVEs drop.

Ready to start? Contact us to arrange the free pilot.

FAQ

Further reading

• Cloudflare WAF documentation