Security
WAF rules
Match and act on requests with firewall, custom, and IP rules before application code runs.
WAF rules let you match request attributes and choose an action before the request reaches cache, static assets, or Functions.
What you can match
Depending on the rule type, matchers can include path, method, IP address, country, ASN, header, user agent, hostname, and environment. See Firewall, Custom rules, and IP rules.
Actions
A matching rule can log, deny, challenge, redirect, or bypass Attack Mode, depending on the action you configure.
Order and bypasses
Earlier security decisions can prevent later layers from running. Test with log-only rules when you need to observe matches without changing traffic. See Security evaluation order.