Managed application protections
Enable Cloudflare-managed rules for known attack patterns and emerging vulnerabilities, including SQL injection and cross-site scripting. Rulesets receive updates and support configuration changes.
Cloudflare WAF
Freemium
Protect web applications and APIs with managed rules, custom request controls, and machine learning detection on supported plans.
What is Cloudflare WAF?
Cloudflare WAF is a hosted web application firewall that inspects HTTP/S requests before they reach your application. It protects web applications and APIs with managed rules and rules you define for your own traffic.
Teams can filter requests by properties such as URL paths, headers, and IP addresses, choose mitigation actions, and review security events to adjust protection. Available detections, rule limits, and analytics depend on the plan.
What can Cloudflare WAF do?
Custom rules and rate limits
Match request properties to block, challenge, or skip selected traffic, and limit repeated requests to particular endpoints. Rules can be managed through the dashboard or supported API workflows.
Machine-learning attack detection
Use attack classifications alongside managed signatures. Business exposes the WAF Attack Score Class field; Enterprise also provides numerical overall, SQLi, XSS, and RCE scores.
Security-event investigation
Review rule matches, actions, and request details to investigate attacks and false positives. Event views can use sampling, so the displayed list is not necessarily every event.
Use Cases
“Protect public applications and APIs”
Apply managed protections and application-specific rules to requests targeting your web services.
“Reduce endpoint abuse”
Set rate limits for repeated login attempts or API requests, using the matching criteria your plan supports.
“Tune protection for real traffic”
Inspect mitigated requests and adjust rules or exceptions when legitimate traffic is affected.
Frequently Asked Questions
What do I need to use it?
Create a Cloudflare account, add your domain, and route the protected traffic through Cloudflare. Configure rules for the domain; multi-zone account-level configuration requires Enterprise access.
What is available for free?
Free includes the default Free Managed Ruleset and up to five custom rules. It does not include ML attack scoring. Unless Cloudflare permits otherwise in writing, self-serve terms restrict collecting or processing credit-card information on properties receiving Free Services.
How are paid plans priced?
WAF capabilities are included in website plans. Pro is US$20/month billed annually or US$25 monthly; Business is US$200/month billed annually or US$250 monthly, before taxes. These are whole-plan prices, not standalone WAF charges. Enterprise is quoted separately; advanced protections can require add-ons.
Can it block legitimate requests?
Yes. Review events and tune rules, especially when using attack-score thresholds. The documentation advises against broadly blocking every request below score 50 because that range can include legitimate traffic.
How is request data handled?
Cloudflare processes proxied requests, IP addresses, and related logs on its network. Customer and end-user content rights remain with them, while Cloudflare can use derived network data to operate and improve services. Service providers and international transfers are covered by its data-processing and privacy terms.
How do subscription renewal and cancellation work?
Self-service paid subscriptions renew automatically at current rates unless canceled in the dashboard before the next billing date. Cancellation normally leaves the current term payable without a refund for unused time. Enterprise orders have their own negotiated terms.
Quick Facts
- Delivery
- Hosted HTTP/S request inspection
- Access
- Free and paid website plans; Enterprise contract
- ML availability
- Business classifications; Enterprise numerical attack scores
Cloudflare WAF Traffic Analysis
Traffic data is for reference only.
- Monthly Visits
- 63.5M
- Global Rank
- #452
- User Bounce Rate
- 41.8%
- Avg. Visit Duration
- 05:22
- Pages per Visit
- 7.19
- Domain Rating
- 94
Traffic Trends
| Jul | 57747445 |
|---|---|
| Aug | 59946857 |
| Sep | 63472795 |
Traffic Sources
Traffic analytics are not available yet.
Top Regions
Traffic analytics are not available yet.
