Security rules

Security rules perform security-related actions on incoming requests that match specified filters. Rules are evaluated and executed in order, from first to last.

Security rules are available in Security > Security rules.

Security rules

The Security rules tab includes a list of different types of rules configured in your domain / zone to protect your applications and resources.

To create a security rule:

1. Log in to the Cloudflare dashboard ↗ and select your account and domain.
2. Go to Security > Security rules.
3. (Optional) Select Templates, and then select a template from the list. You can customize the default configuration of the template before deploying the new rule. Refer to the resources listed in the next step.
4. Select Create rule > select the type of rule you want to create. Refer to the following resources about each rule type:
   • Custom rules
   • Rate limiting rules
   • API sequence rules
   • API JWT validation rules (requires a token configuration)
   • Managed rules exceptions
   • Content security rules (previously known as Page Shield policies)

Notes

The Security rules tab includes functionality available in different products in the previous dashboard navigation structure, such as the WAF, API Shield, and Page Shield.

The tab may show additional rule types if you have configured at least one of the following:

• IP access rules
• User agent blocking rules
• Zone lockdown rules

DDoS protection

The DDoS Protection tab shows the multiple DDoS mitigation services provided by Cloudflare. You can create rules to override these mitigation tools. DDoS attack protection overrides are only available to Enterprise customers with the Advanced DDoS Protection subscription.

To learn more about DDoS protection overrides, refer to the following resources:

• HTTP DDoS attack protection overrides
• Network-layer DDoS attack protection overrides

Note

You define overrides for the Network-layer DDoS attack protection managed ruleset at the account level in Account Home > L3/4 DDoS > Network-layer DDoS Protection.