Cloudflare WAF is the web application firewall built into Cloudflare's network. It checks incoming web and API requests and filters unwanted traffic using rulesets: managed rules that Cloudflare writes and updates, custom rules you write, and rate limiting rules. Some form of it is available on every plan.
Security features built on Cloudflare's Ruleset Engine run in a fixed order: HTTP DDoS protection, then custom rules, rate limiting rules, managed rules and Super Bot Fight Mode. A terminating action such as Block or Managed Challenge stops the request there, so it never reaches the later phases.
Rules that fit at go-live drift as applications change. WAF rules need to change when you ship a feature, and a false positive needs someone who can trace a blocked request to the rule behind it.
The Cloudflare Managed Ruleset and the Cloudflare OWASP Core Ruleset cover common attacks and are updated by Cloudflare. Free plans get the Free Managed Ruleset instead. Some Cloudflare Managed rules are off by default to limit false positives.
Each matching OWASP rule adds to a cumulative threat score, and the ruleset acts when the score crosses a threshold (Medium, 40, by default). Paranoia levels PL1 to PL4 catch more as they rise, and can block more legitimate traffic too.
Custom rules match request fields with expressions and apply actions such as block, managed challenge or skip. The number of rules and regex support depend on the plan.
Rate limiting rules count matching requests and act when a client exceeds the rate you set. Cloudflare notes they are not designed to let a precise number of requests reach your origin.
WAF attack score uses machine learning to rate each request from 1 to 99 for how likely it is to be malicious. Leaked credentials detection checks submitted credentials against known breach data.
An exception skips a managed ruleset or specific rules for matching traffic; an override changes a rule's action or turns it off. Exceptions take priority over overrides, so their scope matters.
| Plan | What it includes |
|---|---|
| Free | Free Managed Ruleset, 5 custom rules, 1 rate limiting rule, the leaked-password detection field and sampled Security Events. |
| Pro | Cloudflare Managed Ruleset and Cloudflare OWASP Core Ruleset, 20 custom rules, 2 rate limiting rules, leaked credentials detection for username and password pairs, and full Security Events. |
| Business | Everything on Pro, plus 100 custom rules with regex support, 5 rate limiting rules, the WAF attack score class, Security Events alerts and account-level Security Analytics. |
| Enterprise | 1,000 custom rules, the full WAF attack score, the Log action for testing rules before enforcing them, payload logging, account-level WAF configuration and up to 90 days of Security Analytics. Rate limiting rule counts depend on the contract; Advanced Rate Limiting and malicious uploads detection are paid add-ons. |
Cloudflare's prices change, so this table lists capabilities only. Vigilbase sells Cloudflare Enterprise licences and runs the WAF under Managed Cloudflare. For one domain on a monthly plan, Vigilbase Shield is the pre-Enterprise option with managed WAF rules, DDoS protection and Super Bot Fight Mode.
Cloudflare WAF pricing by plan →We review WAF, DDoS, bot, TLS, DNS, rate limiting and origin settings, then deploy managed and custom rules for the applications in scope. We do not leave a managed ruleset on defaults and call it done.
We find the security event behind a blocked request, confirm which rule matched and apply the narrowest exception that restores the legitimate journey. Temporary exceptions get a review date and a named reviewer.
Routine changes follow an agreed rhythm and emergency changes have their own path. Each change keeps the previous configuration, the approver, the rollback and the verification, which is what you show internal audit.
A new mobile client, payment integration or campaign page changes what legitimate traffic looks like. We work with your application team so the rules follow the application.
Reports cover blocked threats, changes and recommendations, so you can see what the WAF stopped and what moved.
Core is business-hours governance and change management, with best-effort response. Priority adds 24/7 operations, active threat mitigation within the SLA and a named technical account manager. Critical adds immediate escalation and senior incident leadership.
A form or checkout fails after a security change. We reproduce it safely, correlate the request with a security event and change only the rule involved, then verify the journey and the protection that remains.
Managed WAF operations and change control →Months after go-live, the WAF is often still on defaults and nobody knows which exceptions were meant to be temporary. We review rule coverage, retire stale exceptions and record why each one exists.
When audit asks who changed a WAF rule last quarter, someone in the dashboard is not an answer. Every change we make carries its evidence, approver, rollback and verification.
A launch brings new customers and automated abuse at the same time. We separate the control that interfered from application or payment faults before adjusting anything.
The agreed package names who leads the incident. If the service is not behind Cloudflare yet, emergency onboarding moves it there first and then stabilizes the attack.
When to request Cloudflare emergency help →Vigilbase OS
Vigilbase OS, the cybersecurity operating system, connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place. Its native Cloudflare integration puts your Cloudflare events next to those tools, and the Vigil agent investigates high-severity incidents while Vigilbase analysts handle exceptions.
Cloudflare is the provider where live response actions run today. You choose the autonomy: keep actions off, propose them for approval, or allow low-risk, reversible actions to run. The record shows the investigation, the actions taken and the verification. For providers without live actions, the investigation returns the steps for your team to complete.
Get started with Vigilbase OSCloudflare WAF uses three kinds of rules: managed rules that Cloudflare writes and updates, custom rules you write as expressions on request fields, and rate limiting rules that act when a client exceeds a request rate. Exceptions and overrides adjust how the managed rules apply to your traffic.How a web application firewall worksApplication and API protection
Every Cloudflare plan includes a WAF, but Free plans get only the Free Managed Ruleset, 5 custom rules and 1 rate limiting rule. The Cloudflare Managed Ruleset and the Cloudflare OWASP Core Ruleset need Pro or higher, and custom rules rise to 1,000 on Enterprise.How a web application firewall worksCloudflare Enterprise licensing explained
Find the security event for the blocked request, confirm which rule matched and apply the narrowest exception that fixes the legitimate journey. An exception that skips a whole ruleset has a very different effect from one that skips a single rule.Save the previous configuration and the rollback before the change, verify the journey and the protection that remains afterwards, and give temporary exceptions a review date and a named reviewer.Managed WAF operations and change control
No. Vigilbase Shield is a pre-Enterprise monthly plan for one domain, with managed WAF rules, DDoS protection and Super Bot Fight Mode. This page covers Cloudflare WAF on Cloudflare Enterprise or an existing account, operated under Managed Cloudflare.Managed WAF operations and change controlCompare Core, Priority and Critical
Yes, on Priority and Critical. Vigilbase runs WAF changes and Cloudflare incidents outside business hours on the agreed scope. Core is business-hours governance.WAF work still follows the agreed authority and change-control path. Record the affected application, the rule change, and the verification result so that the team can review what changed and whether legitimate access was restored.Managed WAF operations and change controlCoverage and incident response commitments
Cloudflare WAF features depend on the Cloudflare plan and add-ons. Managed Cloudflare operating fees start at $3,500 a month for Core, $7,500 for Priority and $15,000 for Critical, with the Cloudflare licence scoped in the same quote.Compare Core, Priority and CriticalWhat to check before buying Cloudflare
Cloudflare WAF details on this page are summarized from Cloudflare's documentation. Plans, rule limits and add-ons change, so confirm current terms with Cloudflare or with us before you buy.
Vendor sources checked
Tell us which applications sit behind the WAF and what has broken before. We will scope the licence, the rules and the operating coverage together.
