Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

https://github.com/sefinek/cloudflare-waf-rules

Cloudflare WAF (Web Application Firewall) rules + a script for their automatic updates. Block unwanted and malicious requests to enhance the security of your origin server!
https://github.com/sefinek/cloudflare-waf-rules

antibot antibots cloudflare cloudflare-expression cloudflare-expressions cloudflare-firewall cloudflare-firewall-rules cloudflare-waf cloudflare-waf-expression cloudflare-waf-expressions cloudflare-waf-rules express expression expressions expressjs nodejs server server-safety server-security waf

Last synced: 19 days ago
JSON representation

Cloudflare WAF (Web Application Firewall) rules + a script for their automatic updates. Block unwanted and malicious requests to enhance the security of your origin server!

Awesome Lists containing this project

README 

        
☁️ Cloudflare Web Application Firewall Rules



By using these WAF expressions, you can effectively block all unnecessary and potentially malicious requests targeting your origin server, thereby enhancing its security.

If you find this repository useful, I would greatly appreciate it if you could give it a **star** ⭐. Thank you!



> [!TIP]

> - Use a [dedicated script](#automatic-installation) to automatically update rules for each zone.

> - Do you want to report events from Cloudflare WAF to AbuseIPDB? See [Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB).

> - Join my [Discord server](https://discord.gg/53DBjTuzgZ) if you need help or want to receive notifications about important updates.



Cloudflare Web Application Firewall [WAF] Rules 



## 🛡️ What Can This List Block?

| **Type**                        | **Brief Description**                                                                                                                                                                                                     |

|---------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

| **Sensitive Files and Folders** | Access to critical files and directories, such as `.git`, `.env`, and `.htaccess`, which often contain sensitive information requiring protection. Also prevents access to other configuration files and keys, e.g., SSH. |

| **Common Attack Vectors**       | URLs with patterns commonly used in attacks.                                                                                                                                                                              |

| **Backup Files**                | Requests for backup files that may contain sensitive data.                                                                                                                                                                |

| **Outdated Browsers**           | Versions of browsers, often used by bots for automated attacks (DDoS attacks from botnets, which frequently utilize outdated user agents) or unnecessary website indexing.                                                |

| **Useless Bots**                | Various unwanted and unnecessary web crawlers as well as known malicious bots. Blocking them can reduce server load.                                                                                                      |

| **Specific IP Addresses & ASN** | Traffic from known malicious IP addresses and ASNs. The list also includes IP addresses associated with botnets.                                                                                                          |



> [!IMPORTANT]  

> It is also recommended to **disable** the `Bot Fight Mode` feature in the `Security` tab.  

> Although this feature helps detect and block automated bot traffic, it can inadvertently block safe, legitimate bots as well, which is not our intention.





   
>> View Main Expressions <<


   
>> View Expressions for Caching <<





## ✅ Usage

### Automatic (Recommended)


You can use the JavaScript code from this repository to automatically update the rules throughout the day.  

There's no need to add them manually, as the script takes care of everything for you (:



#### Requirements

1. [Node.js LTS + npm](https://nodejs.org)

2. [PM2](https://www.npmjs.com/package/pm2) (`npm i pm2 -g`)

3. [Git](https://git-scm.com/downloads)

4. Linux (also works on Windows Server)



#### Tutorial (for Linux)

1. Clone this repository:

   ```bash

   git clone https://github.com/sefinek/Cloudflare-WAF-Rules.git

   ```

2. Install the necessary dependencies:

   ```bash

   cd Cloudflare-WAF-Expressions && npm install

   ```

3. Copy the `.env.default` file and rename it to `.env`:

   ```bash

   cp .env.default .env

   ```

4. Open the `.env` file and ensure `NODE_ENV` is set to `production`. Paste your Cloudflare token in place of `CF_API_TOKEN`.

   ```bash

   nano .env

   ```

   ![brave_JDyTDLnUFonD.png](assets/images/brave_JDyTDLnUFonD.png)

5. Run the script 24/7 using PM2:

   ```bash

   pm2 start && pm2 save

   ```

6. Configure PM2 to start on system boot:

   ```bash

   pm2 startup

   ```

   Then, execute the generated command from the output.



### Manually

1. Log in to your [Cloudflare](https://dash.cloudflare.com) account.

2. Select the domain where you want to add the expressions.

3. Click on the `Security` tab, then choose `WAF` from the dropdown menu.

4. In the `Custom rules` tab, click the `Create rule` button.

5. Copy the expressions from the [markdown/expressions.md](markdown/expressions.md) file.

6. Click `Edit expression` and paste the copied expressions.

7. Click `Deploy` to save the changes. Repeat this process for the remaining parts of the expressions, ensuring you select the appropriate action (Block or Managed Challenge) as specified in the file.

8. Done! The expressions are now active and will start blocking unwanted traffic to your origin server. Make sure your website functions correctly, and visit this repository periodically for the latest updates.



## 🔥 DDoS Protection (Additional Security Measures)

Cloudflare offers many settings that need to be configured manually according to your preferences.

In this tutorial, we will enable only those that will safeguard your server from DDoS attacks.

Keep in mind that there are many more measures available to mitigate DDoS attacks.



### 1: Creating DDoS L7 Ruleset

#### Security > DDoS > Deploy a DDoS override

1. **Override name:** DDoS L7 ruleset

2. **Ruleset action:** Block

3. **Ruleset sensitivity:** Default



### 2: Rate Limits

#### Security > Rate limiting rules > Create rule

1. **Rule name:** Default rate limit

2. Expression: `(starts_with(http.request.uri.path, "/"))`

   - **Field:** URI Path

   - **Operator:** starts with

   - **Value:** /

3. When rate exceeds…

   - **Requests:** 200 (you should adjust this value yourself based on your website's traffic)

   - **Period:** 10 seconds

4. Then take action…

   - **Choose action:** Block

5. For duration…

   - **Duration:** 10 seconds



### 3: Good to Know

1. Make sure that your server's IP address has not been leaked.

2. Your server should accept only requests coming from Cloudflare. Accessing your website directly, bypassing Cloudflare, should not be possible.

3. Configure rate limits on your server to reduce its load during a DDoS attack.



## 🤝 Pull requests

If you have any suggestions or improvements, feel free to open a [Pull request](https://github.com/sefinek/Cloudflare-WAF-Rules/pulls).

Your contribution will be appreciated and will help keep this list up-to-date and effective in combating the latest threats. Thank you!



## 🔖 [MIT License](LICENSE)

Copyright 2023-2025 © by Sefinek. All Rights Reserved.