Richer WAF conditions and verified bots

Custom WAF rules now match a richer set of conditions, verified crawlers can pass Attack Mode, and Stripe webhook traffic skips the challenge so billing events keep flowing.

Richer match conditions

Build rules on path, IP, country, and additional request attributes so you can allow partner ranges, challenge risky geos, or deny admin paths at the edge. Actions still include allow, deny, and challenge.

Order and specificity matter. Put narrow allow rules ahead of broad challenges when you need exceptions for known clients.

Verified bots and webhooks

Verified search crawlers can complete or bypass Attack Mode when the platform recognizes them, so legitimate indexing isn’t blocked during protection windows. Stripe webhook endpoints skip the challenge so signature-validated events reach your app.

Tune rules in Security and confirm outcomes in Observability firewall events. Docs: Custom firewall rules and Attack Mode.