# Managed Rules
import { Render, RuleID } from "~/components";
[Attack Signature Detection](/waf/detections/attack-signature-detection/#compare-attack-signature-detection-and-managed-rules) uses the same signatures as Cloudflare Managed Rules. It records match metadata without applying an action by itself.
## Available managed rulesets
- [**Cloudflare Managed Ruleset**](/waf/managed-rules/reference/cloudflare-managed-ruleset/): Created by the Cloudflare security team, this ruleset provides fast and effective protection for all of your applications. It covers known attack techniques and zero-day vulnerabilities (newly discovered flaws with no available patch). The ruleset is updated frequently to address new threats and reduce false positives (legitimate requests incorrectly flagged).
Ruleset ID:
- [**Cloudflare OWASP Core Ruleset**](/waf/managed-rules/reference/owasp-core-ruleset/): Cloudflare's implementation of the Open Web Application Security Project (OWASP) ModSecurity Core Rule Set. This ruleset uses a scoring model — each matching rule adds its score to a cumulative [threat score](/waf/managed-rules/reference/owasp-core-ruleset/concepts/#request-threat-score), and the WAF executes the configured action when the score exceeds the [threshold](/waf/managed-rules/reference/owasp-core-ruleset/concepts/#score-threshold).
Ruleset ID:
- [**Cloudflare Exposed Credentials Check**](/waf/managed-rules/reference/exposed-credentials-check/): Deploys an automated credentials check on your end-user authentication endpoints. For any credential pair, the Cloudflare WAF performs a lookup against a public database of stolen credentials to determine if they were previously compromised. Cloudflare recommends that you use [leaked credentials detection](/waf/detections/leaked-credentials/) instead of this ruleset.
Ruleset ID:
- **Cloudflare Free Managed Ruleset**: Available on all Cloudflare plans. Provides protection against high-impact and widely exploited vulnerabilities. The rules are safe to deploy on most applications. If you have already deployed the Cloudflare Managed Ruleset, you do not need this ruleset — the Cloudflare Managed Ruleset includes broader coverage.
Ruleset ID:
The following managed rulesets run in a response phase:
- [**Cloudflare Sensitive Data Detection**](/waf/managed-rules/reference/sensitive-data-detection/): Created by Cloudflare to address common data loss threats. These rules monitor the download of specific sensitive data — for example, financial and personally identifiable information.
Ruleset ID:
## Availability
The managed rulesets you can deploy depend on your Cloudflare plan.
| | Free | Pro | Business | Enterprise |
| - | - | - | - | - |
| Availability | Yes | Yes | Yes | Yes |
| Free Managed Ruleset | Yes | Yes | Yes | Yes |
| Cloudflare Managed Ruleset | No | Yes | Yes | Yes |
| Cloudflare OWASP Core Ruleset | No | Yes | Yes | Yes |
| Cloudflare Exposed Credentials Check (deprecated) | No | Yes | Yes | Yes |
| Cloudflare Sensitive Data Detection | No | No | No | Yes |
## Interaction with other app security features
## Important remarks
### Maximum body size
Managed rules inspect the body of each incoming request up to a maximum size. This limit varies by plan:
- For Enterprise customers, the maximum body size is 128 KB.
- For other paid plans, the limit is lower by default — contact your account team or Cloudflare Support to increase the limit.
- For users in the Free plan, the limit is 1 MB.
Request content beyond this limit may not be fully analyzed, which can affect how managed rules behave. For example, the [OWASP Core Ruleset](/waf/managed-rules/reference/owasp-core-ruleset/) calculates a cumulative [threat score](/waf/managed-rules/reference/owasp-core-ruleset/concepts/#request-threat-score) based on the scores of individual rules that match a request. Larger payloads give more content for rules to match against, which increases the score and makes it more likely to exceed the [score threshold](/waf/managed-rules/reference/owasp-core-ruleset/concepts/#score-threshold) — resulting in a false positive.
If included in your plan, you can use [request body fields](/ruleset-engine/rules-language/fields/reference/?field-category=Body) in [custom rules](/waf/custom-rules/) to apply appropriate actions to requests that have not been fully analyzed. The `http.request.body.truncated` field indicates whether the request body was truncated, while `http.request.headers.truncated` indicates whether the request contained too many headers for all of them to be included.
### Zone-level deployment
At the zone level, you can deploy each managed ruleset once. At the [account level](/waf/account/managed-rulesets/), you can deploy each managed ruleset multiple times, which allows you to apply different configurations of the same ruleset to different subsets of incoming traffic.
## Execution order
WAF Managed Rules run in the `http_request_firewall_managed` phase, which executes **after**:
- HTTP DDoS Attack Protection (`ddos_l7` phase)
- Custom Rules (`http_request_firewall_custom` phase)
- Rate Limiting Rules (`http_ratelimit` phase)
This means a rule with a terminal action (such as Block or Managed Challenge) in any of these earlier phases prevents Managed Rules from evaluating that request. For the complete security feature execution order, refer to [Security features interoperability](/waf/feature-interoperability/).
### WAF exceptions
WAF exceptions (skip rules) are rules with a `skip` action deployed to the `http_request_firewall_managed` phase entry-point ruleset. They are evaluated in list order within the entry-point ruleset — a skip rule only bypasses `execute` rules listed after it. Place exceptions before the managed ruleset execute rules they are intended to skip. For more information, refer to [WAF exceptions](/waf/managed-rules/waf-exceptions/).