Skip to content

Commit a70a90e

Browse files
authored
[WAF, Page Shield] Add links to Learning Center (#19447)
1 parent 25dcecc commit a70a90e

File tree

15 files changed

+67
-72
lines changed

15 files changed

+67
-72
lines changed

src/content/docs/page-shield/how-it-works/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ description: Page Shield tracks resources (such as scripts) loaded by your
1212

1313
import { GlossaryTooltip } from "~/components";
1414

15-
Page Shield helps manage resources loaded by your website visitors, including scripts, their connections, and cookies. It can trigger alert notifications when resources change or are considered malicious.
15+
Page Shield helps manage resources loaded by your website visitors, including scripts, their connections, and [cookies](https://www.cloudflare.com/learning/privacy/what-are-cookies/). It can trigger alert notifications when resources change or are considered malicious.
1616

1717
Enabling Page Shield adds a <GlossaryTooltip term="content security policy (CSP)" link="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP">Content Security Policy (CSP)</GlossaryTooltip> deployed with a [report-only directive](/page-shield/reference/csp-header/) to collect information from the browser. This allows Cloudflare to provide you with a list of all scripts running on your application and the connections they make to third-party endpoints. Page Shield also monitors ingress and egress traffic for cookies, either set by origin servers or by the visitor's browser.
1818

src/content/docs/ruleset-engine/reference/phases-list.mdx

Lines changed: 36 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,15 @@ title: Phases list
33
pcx_content_type: reference
44
sidebar:
55
order: 1
6-
76
---
87

9-
import { Render } from "~/components"
8+
import { Render } from "~/components";
109

1110
The following tables list the [phases](/ruleset-engine/about/phases/) of Cloudflare products powered by the Ruleset Engine, in the order those phases are executed. Some products such as the Cloudflare Web Application Firewall have more than one associated phase.
1211

1312
## Network layer
1413

15-
Network-layer phases apply to packets received on the Cloudflare global network.
16-
17-
14+
[Network-layer](https://www.cloudflare.com/learning/ddos/glossary/open-systems-interconnection-model-osi/) phases apply to packets received on the Cloudflare global network.
1815

1916
| Phase name | Used in product/feature |
2017
| ---------------- | ------------------------------------------------------------------------------------------------ |
@@ -23,58 +20,51 @@ Network-layer phases apply to packets received on the Cloudflare global network.
2320
| `mt_managed` | [Magic Firewall managed rulesets](/magic-firewall/how-to/enable-managed-rulesets/) |
2421
| `mt_ids_managed` | [Magic Firewall Intrusion Detection System (IDS)](/magic-firewall/about/ids/) |
2522

26-
27-
2823
## Application layer
2924

30-
Application-layer phases apply to requests received on the Cloudflare global network.
25+
[Application-layer](https://www.cloudflare.com/learning/ddos/what-is-layer-7/) phases apply to requests received on the Cloudflare global network.
3126

3227
### Request phases
3328

3429
The phases execute in the order they appear in the table.
3530

36-
37-
38-
| Phase name | Used in product/feature |
39-
| ----------------------------------- | ------------------------------------------------------------------------------------------------------ |
40-
| `http_request_sanitize` | [URL normalization](/rules/normalization/) |
41-
| `http_request_dynamic_redirect` | [Single Redirects](/rules/url-forwarding/single-redirects/) |
42-
| `http_request_transform` | [Rewrite URL Rules](/rules/transform/url-rewrite/) |
43-
| *N/A* (internal phase) | [Waiting Room Rules](/waiting-room/additional-options/waiting-room-rules/) |
44-
| `http_config_settings` | [Configuration Rules](/rules/configuration-rules/) |
45-
| `http_request_origin` | [Origin Rules](/rules/origin-rules/) |
46-
| `ddos_l7`\* | [HTTP DDoS Attack Protection](/ddos-protection/managed-rulesets/http/) |
47-
| `http_request_api_gateway` | [API Gateway](/api-shield/api-gateway/) |
48-
| `http_request_firewall_custom` | [Custom rules (Web Application Firewall)](/waf/custom-rules/) |
49-
| `http_ratelimit` | [Rate limiting rules (WAF)](/waf/rate-limiting-rules/) |
50-
| *N/A* (internal phase) | [API Shield](/api-shield/) |
51-
| `http_request_firewall_managed` | [WAF Managed Rules](/waf/managed-rules/) |
52-
| `http_request_sbfm` | [Super Bot Fight Mode](/bots/get-started/pro/) |
53-
| *N/A* (internal phase) | [Cloudflare Access](/cloudflare-one/policies/access/) |
54-
| `http_request_redirect` | [Bulk Redirects](/rules/url-forwarding/bulk-redirects/) |
55-
| *N/A* (internal phase) | [Managed Transforms](/rules/transform/managed-transforms/) |
56-
| `http_request_late_transform` | [HTTP Request Header Modification Rules](/rules/transform/request-header-modification/) |
57-
| `http_request_cache_settings` | [Cache Rules](/cache/how-to/cache-rules/) |
58-
| `http_request_snippets` | [Snippets](/rules/snippets/) |
59-
| `http_request_cloud_connector` | [Cloud Connector](/rules/cloud-connector/) |
60-
61-
62-
\* *This phase is for configuration purposes only — the corresponding rules will not be executed at this stage in the request handling process.*
31+
| Phase name | Used in product/feature |
32+
| ------------------------------- | --------------------------------------------------------------------------------------- |
33+
| `http_request_sanitize` | [URL normalization](/rules/normalization/) |
34+
| `http_request_dynamic_redirect` | [Single Redirects](/rules/url-forwarding/single-redirects/) |
35+
| `http_request_transform` | [Rewrite URL Rules](/rules/transform/url-rewrite/) |
36+
| _N/A_ (internal phase) | [Waiting Room Rules](/waiting-room/additional-options/waiting-room-rules/) |
37+
| `http_config_settings` | [Configuration Rules](/rules/configuration-rules/) |
38+
| `http_request_origin` | [Origin Rules](/rules/origin-rules/) |
39+
| `ddos_l7`\* | [HTTP DDoS Attack Protection](/ddos-protection/managed-rulesets/http/) |
40+
| `http_request_api_gateway` | [API Gateway](/api-shield/api-gateway/) |
41+
| `http_request_firewall_custom` | [Custom rules (Web Application Firewall)](/waf/custom-rules/) |
42+
| `http_ratelimit` | [Rate limiting rules (WAF)](/waf/rate-limiting-rules/) |
43+
| _N/A_ (internal phase) | [API Shield](/api-shield/) |
44+
| `http_request_firewall_managed` | [WAF Managed Rules](/waf/managed-rules/) |
45+
| `http_request_sbfm` | [Super Bot Fight Mode](/bots/get-started/pro/) |
46+
| _N/A_ (internal phase) | [Cloudflare Access](/cloudflare-one/policies/access/) |
47+
| `http_request_redirect` | [Bulk Redirects](/rules/url-forwarding/bulk-redirects/) |
48+
| _N/A_ (internal phase) | [Managed Transforms](/rules/transform/managed-transforms/) |
49+
| `http_request_late_transform` | [HTTP Request Header Modification Rules](/rules/transform/request-header-modification/) |
50+
| `http_request_cache_settings` | [Cache Rules](/cache/how-to/cache-rules/) |
51+
| `http_request_snippets` | [Snippets](/rules/snippets/) |
52+
| `http_request_cloud_connector` | [Cloud Connector](/rules/cloud-connector/) |
53+
54+
\* _This phase is for configuration purposes only — the corresponding rules will not be executed at this stage in the request handling process._
6355

6456
<Render file="bfm-change-notice" product="bots" />
6557

6658
### Response phases
6759

6860
The phases execute in the order they appear in the table.
6961

70-
71-
72-
| Phase name | Used in product/feature |
73-
| --------------------------------- | ---------------------------------------------------------------------------------------------------- |
74-
| `http_custom_errors` | [Custom Error Responses](/rules/custom-error-responses/) |
75-
| *N/A* (internal phase) | [Managed Transforms](/rules/transform/managed-transforms/) |
76-
| `http_response_headers_transform` | [HTTP Response Header Modification Rules](/rules/transform/response-header-modification/) |
77-
| `http_ratelimit` | [Rate limiting rules](/waf/rate-limiting-rules/) (when they use response information) |
78-
| `http_response_compression` | [Compression Rules](/rules/compression-rules/) |
79-
| `http_response_firewall_managed` | [Cloudflare Sensitive Data Detection](/waf/managed-rules/) (Data Loss Prevention) |
80-
| `http_log_custom_fields` | [Logpush custom fields](/logs/reference/custom-fields/) |
62+
| Phase name | Used in product/feature |
63+
| --------------------------------- | ----------------------------------------------------------------------------------------- |
64+
| `http_custom_errors` | [Custom Error Responses](/rules/custom-error-responses/) |
65+
| _N/A_ (internal phase) | [Managed Transforms](/rules/transform/managed-transforms/) |
66+
| `http_response_headers_transform` | [HTTP Response Header Modification Rules](/rules/transform/response-header-modification/) |
67+
| `http_ratelimit` | [Rate limiting rules](/waf/rate-limiting-rules/) (when they use response information) |
68+
| `http_response_compression` | [Compression Rules](/rules/compression-rules/) |
69+
| `http_response_firewall_managed` | [Cloudflare Sensitive Data Detection](/waf/managed-rules/) (Data Loss Prevention) |
70+
| `http_log_custom_fields` | [Logpush custom fields](/logs/reference/custom-fields/) |

src/content/docs/waf/analytics/security-analytics.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Security Analytics displays information about all incoming HTTP requests for you
1212
Use the Security Analytics dashboard to:
1313

1414
- View the traffic distribution for your domain.
15-
- Understand which traffic is being mitigated by Cloudflare security products, and where non-mitigated traffic is being served from (Cloudflare global network or origin server).
15+
- Understand which traffic is being mitigated by Cloudflare security products, and where non-mitigated traffic is being served from (Cloudflare global network or [origin server](https://www.cloudflare.com/learning/cdn/glossary/origin-server/)).
1616
- Analyze suspicious traffic and create tailored WAF custom rules based on applied filters.
1717
- Learn more about Cloudflare's security scores (<GlossaryTooltip term="attack score" link="/waf/detections/attack-score/">attack score</GlossaryTooltip>, [bot score](/bots/concepts/bot-score/), [malicious uploads](/waf/detections/malicious-uploads/), and [leaked credentials](/waf/detections/leaked-credentials/) results) with real data.
1818
- [Find an appropriate rate limit](/waf/rate-limiting-rules/find-rate-limit/) for incoming traffic.

src/content/docs/waf/custom-rules/use-cases/allow-traffic-from-verified-bots.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,5 @@ The rule expression uses the [`cf.client.bot`](/ruleset-engine/rules-language/fi
1717

1818
- [Use case: Challenge bad bots](/waf/custom-rules/use-cases/challenge-bad-bots/)
1919
- [Cloudflare bot solutions](/bots/)
20-
- [Troubleshooting: Bings Site Scan blocked by a WAF managed rule](/waf/troubleshooting/blocked-bing-site-scans/)
20+
- [Troubleshooting: Bing's Site Scan blocked by a WAF managed rule](/waf/troubleshooting/blocked-bing-site-scans/)
2121
- [Learning Center: What is a web crawler?](https://www.cloudflare.com/learning/bots/what-is-a-web-crawler/)

src/content/docs/waf/custom-rules/use-cases/challenge-bad-bots.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ When a request is definitely automated (score of 1) or likely automated (scores
5757

5858
#### Exempt API traffic
5959

60-
Since Bot Management detects automated users, you need to explicitly allow your **good** automated traffic⁠ — this includes your APIs and partner APIs.
60+
Since Bot Management detects automated users, you need to explicitly allow your **good** automated traffic⁠ — this includes your [APIs](https://www.cloudflare.com/learning/security/api/what-is-an-api/) and partner APIs.
6161

6262
This example offers the same protection as the browser-only rule, but allows automated traffic to your API.
6363

src/content/docs/waf/detections/attack-score.mdx

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,17 @@ This feature is available to Enterprise customers. Business plans have access to
2424

2525
The Cloudflare WAF provides the following attack score fields:
2626

27-
| Score | Data type | Minimum plan required | Attack vector | Field |
28-
| ---------------------- | --------- | --------------------- | --------------------------- | --------------------------------------------------------------------------------------------- |
29-
| WAF Attack Score | Number | Enterprise | N/A (global score) | [`cf.waf.score`](/ruleset-engine/rules-language/fields/reference/cf.waf.score/) |
30-
| WAF SQLi Attack Score | Number | Enterprise | SQL injection (SQLi) | [`cf.waf.score.sqli`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.sqli/) |
31-
| WAF XSS Attack Score | Number | Enterprise | Cross-site scripting (XSS) | [`cf.waf.score.xss`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.xss/) |
32-
| WAF RCE Attack Score | Number | Enterprise | Remote Code Execution (RCE) | [`cf.waf.score.rce`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.rce/) |
33-
| WAF Attack Score Class | String | Business | N/A (global classification) | [`cf.waf.score.class`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.class/) |
27+
| Score | Data type | Minimum plan required | Attack vector | Field |
28+
| ---------------------- | --------- | --------------------- | -------------------------------- | ------------------------------------------------------------------------------------------- |
29+
| WAF Attack Score | Number | Enterprise | N/A (global score) | [`cf.waf.score`](/ruleset-engine/rules-language/fields/reference/cf.waf.score/) |
30+
| WAF SQLi Attack Score | Number | Enterprise | [SQL injection][1] (SQLi) | [`cf.waf.score.sqli`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.sqli/) |
31+
| WAF XSS Attack Score | Number | Enterprise | [Cross-site scripting][2] (XSS) | [`cf.waf.score.xss`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.xss/) |
32+
| WAF RCE Attack Score | Number | Enterprise | [Remote code execution][3] (RCE) | [`cf.waf.score.rce`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.rce/) |
33+
| WAF Attack Score Class | String | Business | N/A (global classification) | [`cf.waf.score.class`](/ruleset-engine/rules-language/fields/reference/cf.waf.score.class/) |
34+
35+
[1]: https://www.cloudflare.com/learning/security/threats/sql-injection/
36+
[2]: https://www.cloudflare.com/learning/security/threats/cross-site-scripting/
37+
[3]: https://www.cloudflare.com/learning/security/what-is-remote-code-execution/
3438

3539
You can use these fields in expressions of [custom rules](/waf/custom-rules/) and [rate limiting rules](/waf/rate-limiting-rules/). Attack score fields of data type `Number` vary between `1` and `99` with the following meaning:
3640

src/content/docs/waf/detections/leaked-credentials/get-started.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ For additional examples, refer to [Mitigation examples](/waf/detections/leaked-c
7676

7777
### Handle detected leaked credentials at the origin server
7878

79-
Additionally, you may want to handle leaked credentials detected by Cloudflare at your origin server.
79+
Additionally, you may want to handle leaked credentials detected by Cloudflare at your [origin server](https://www.cloudflare.com/learning/cdn/glossary/origin-server/).
8080

8181
1. Turn on the [**Add Leaked Credentials Checks Header** managed transform](/rules/transform/managed-transforms/reference/#add-leaked-credentials-checks-header).
8282

src/content/docs/waf/detections/leaked-credentials/index.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ sidebar:
77
label: Leaked credentials
88
---
99

10-
The leaked credentials [traffic detection](/waf/detections/) scans incoming requests for previously leaked credentials (usernames and passwords) previously leaked from data breaches.
10+
The leaked credentials [traffic detection](/waf/detections/) scans incoming requests for previously leaked credentials (usernames and passwords) previously leaked from [data breaches](https://www.cloudflare.com/learning/security/what-is-a-data-breach/).
1111

1212
:::note
1313
If you are currently using [Exposed Credentials Check](/waf/managed-rules/check-for-exposed-credentials/) (a previous implementation) and want to upgrade to leaked credentials detection, refer to our [upgrade guide](/waf/managed-rules/check-for-exposed-credentials/upgrade-to-leaked-credentials-detection/).
@@ -26,7 +26,7 @@ In addition, leaked credentials detection provides a [managed transform](/rules/
2626
One common approach used in web applications when detecting the use of stolen credentials is to warn end users about the situation and ask them to update their password. You can do this based on the managed header received at your origin server.
2727

2828
:::note
29-
Cloudflare may detect leaked credentials either because an attacker is performing a credential stuffing attack or because a legitimate end user is reusing a previously leaked password.
29+
Cloudflare may detect leaked credentials either because an attacker is performing a [credential stuffing](https://www.cloudflare.com/learning/bots/what-is-credential-stuffing/) attack or because a legitimate end user is reusing a previously leaked password.
3030
:::
3131

3232
## Availability

0 commit comments

Comments
 (0)