Security rules

import { DashButton, Render } from "~/components";

Security rules perform security-related actions on incoming requests that match specified filters. Rules are evaluated and executed in order, from first to last.

You can create Security Rules from reviewed Attack Signature Detection confidence, category, and Ref metadata.

To access security rules in the new security dashboard, go to the Security rules page.

Security rules

The Security rules tab includes a list of different types of rules configured in your domain/zone to protect your applications and resources.

To create a security rule:

1. In the Cloudflare dashboard, go to the Security rules page.

2. (Optional) Select Templates, and then select a template from the list. You can customize the default configuration of the template before deploying the new rule. Refer to the resources listed in the next step.

3. Select Create rule > select the type of rule you want to create. Refer to the following resources about each rule type:

   • Custom rules
   • Rate limiting rules
   • API sequence rules
   • API JWT validation rules (requires a token configuration)
   • Managed rules exceptions
   • Content security rules (previously known as policies)

:::note[Notes]

To deploy a managed ruleset, go to the Security Settings page. For more information, refer to Deploy a managed ruleset.

The Security rules tab includes functionality available in different products in the previous dashboard navigation structure, such as the WAF, API Shield, and client-side security.

The tab may show additional rule types if you have configured at least one of the following:

• IP access rules
• User agent blocking rules
• Zone lockdown rules

:::

DDoS protection

The DDoS protection tab shows the multiple DDoS mitigation services provided by Cloudflare. You can create rules to override these mitigation tools. DDoS attack protection overrides are only available to Enterprise customers with the Advanced DDoS Protection subscription.

To learn more about DDoS protection overrides, refer to the following resources:

• HTTP DDoS attack protection overrides
• Network-layer DDoS attack protection overrides

:::note You define overrides for the Network-layer DDoS attack protection managed ruleset at the account level. :::

Interaction between different app security features

<Render file="app-security-interoperability" product="waf" params={{ botsFeatureName: "Super Bot Fight Mode" }} />