diff --git a/src/content/docs/waf/analytics/security-analytics.mdx b/src/content/docs/waf/analytics/security-analytics.mdx index 9c8e5491bf96fac..614c6ffd54adeb9 100644 --- a/src/content/docs/waf/analytics/security-analytics.mdx +++ b/src/content/docs/waf/analytics/security-analytics.mdx @@ -43,7 +43,10 @@ To use Security Analytics: 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account. 2. Go to the account or zone/domain dashboard: - - For the zone/domain dashboard, select your domain and go to **Security** > **Analytics**. + - For the zone/domain dashboard, go to the **Analytics** page. + + + - For the account dashboard, go to the **Security Analytics** page. diff --git a/src/content/docs/waf/analytics/security-events.mdx b/src/content/docs/waf/analytics/security-events.mdx index 3dbe3dac55f3066..0f5fe6df4ddf702 100644 --- a/src/content/docs/waf/analytics/security-events.mdx +++ b/src/content/docs/waf/analytics/security-events.mdx @@ -5,7 +5,14 @@ sidebar: order: 2 --- -import { FeatureTable, GlossaryTooltip, Steps, DashButton } from "~/components"; +import { + FeatureTable, + GlossaryTooltip, + Steps, + Tabs, + TabItem, + DashButton, +} from "~/components"; Security Events allows you to review mitigated requests and helps you tailor your security configurations. @@ -28,8 +35,19 @@ Available features vary according to your Cloudflare plan: To open Security Events for a given zone: -- Old dashboard: Go to **Security** > **Events**. -- New security dashboard: Go to **Security** > **Analytics** > **Events** tab. + + +- In the Cloudflare dashboard, go to **Security** > **Events**. + + + +1. In the Cloudflare dashboard, go to the **Analytics** page. + + + +2. Select the **Events** tab. + + Additionally, Enterprise customers have access to the account-level dashboard: diff --git a/src/content/docs/waf/concepts.mdx b/src/content/docs/waf/concepts.mdx index 212ee9e2eaf8f9d..b9e2edfdf95464f 100644 --- a/src/content/docs/waf/concepts.mdx +++ b/src/content/docs/waf/concepts.mdx @@ -5,7 +5,7 @@ sidebar: order: 3 --- -import { GlossaryTooltip, Render } from "~/components"; +import { GlossaryTooltip, Render, DashButton } from "~/components"; @@ -37,7 +37,6 @@ The two main roles of the Cloudflare WAF are the following: - **Mitigation**: Blocks, challenges, or throttles requests through different mitigation features such as [custom rules](/waf/custom-rules/), [Managed Rules](/waf/managed-rules/), and [rate limiting rules](/waf/rate-limiting-rules/). Rules that mitigate traffic can include scores from traffic scans in their expressions to better address possibly malicious requests. :::caution[Warning] - Enabling traffic detections will not apply any mitigation measures to incoming traffic; detections only provide signals that you can use to define your attack mitigation strategy. ::: @@ -51,10 +50,12 @@ The WAF currently provides the following detections for finding security threats - [**Firewall for AI**](/waf/detections/firewall-for-ai/): Helps protect your services powered by large language models (LLMs) against abuse. - [**Bot score**](/bots/concepts/bot-score/): Scores traffic on a scale from 1 (likely to be a bot) to 99 (likely to be human). -To enable traffic detections in the Cloudflare dashboard, go to your domain > **Security** > **Settings**. +To enable traffic detections in the Cloudflare dashboard, go to the Security **Settings** page. + + :::note -Currently, you cannot manage the [bot score](/bots/concepts/bot-score/) and [attack score](/waf/detections/attack-score/) detections from **Security** > **Settings**. Refer to the documentation of each feature for availability details. +Currently, you cannot manage the [bot score](/bots/concepts/bot-score/) and [attack score](/waf/detections/attack-score/) detections from the **Settings** page. Refer to the documentation of each feature for availability details. ::: --- diff --git a/src/content/docs/waf/custom-rules/create-dashboard.mdx b/src/content/docs/waf/custom-rules/create-dashboard.mdx index 710b3bd31e9070f..2fc2ec8be0b0764 100644 --- a/src/content/docs/waf/custom-rules/create-dashboard.mdx +++ b/src/content/docs/waf/custom-rules/create-dashboard.mdx @@ -10,7 +10,7 @@ head: content: Create a custom rule in the dashboard --- -import { Render, Tabs, TabItem, Steps } from "~/components"; +import { Render, Tabs, TabItem, Steps, DashButton } from "~/components"; @@ -40,24 +40,24 @@ import { Render, Tabs, TabItem, Steps } from "~/components"; -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. +1. In the Cloudflare dashboard, go to the **Security rules** page. -2. Go to **Security** > **Security rules**. + -3. To create a new empty rule, select **Create rule** > **Custom rules**. To duplicate an existing rule, select the three dots next to it > **Duplicate**. +2. To create a new empty rule, select **Create rule** > **Custom rules**. To duplicate an existing rule, select the three dots next to it > **Duplicate**. -4. +3. Enter a descriptive name for the rule in **Rule name**. ![Custom rule creation page in the Cloudflare dashboard](~/assets/images/waf/custom-rules/firewall-custom-rule-create.png) -5. Under **If incoming requests match**, use the **Field** drop-down list to choose an HTTP property. For each request, the value of the property you choose for **Field** is compared to the value you specify for **Value** using the operator selected in **Operator**. +4. Under **If incoming requests match**, use the **Field** drop-down list to choose an HTTP property. For each request, the value of the property you choose for **Field** is compared to the value you specify for **Value** using the operator selected in **Operator**. -6. Under **Then take action**, select the rule action in the **Choose action** dropdown. For example, selecting _Block_ tells Cloudflare to refuse requests that match the conditions you specified. +5. Under **Then take action**, select the rule action in the **Choose action** dropdown. For example, selecting _Block_ tells Cloudflare to refuse requests that match the conditions you specified. -7. (Optional) If you selected the _Block_ action, you can [configure a custom response](#configure-a-custom-response-for-blocked-requests). +6. (Optional) If you selected the _Block_ action, you can [configure a custom response](#configure-a-custom-response-for-blocked-requests). -8. To save and deploy your rule, select **Deploy**. If you are not ready to deploy your rule, select **Save as Draft**. +7. To save and deploy your rule, select **Deploy**. If you are not ready to deploy your rule, select **Save as Draft**. diff --git a/src/content/docs/waf/custom-rules/skip/index.mdx b/src/content/docs/waf/custom-rules/skip/index.mdx index 83242ac0522a07b..3dfcfb60879bd6e 100644 --- a/src/content/docs/waf/custom-rules/skip/index.mdx +++ b/src/content/docs/waf/custom-rules/skip/index.mdx @@ -8,7 +8,7 @@ head: content: Configure a custom rule with the Skip action --- -import { TabItem, Tabs, Steps } from "~/components"; +import { TabItem, Tabs, Steps, DashButton } from "~/components"; Use the _Skip_ action in a custom rule to skip one or more security features. A rule configured with the _Skip_ action is also known as a skip rule. @@ -40,21 +40,21 @@ For more information on the available options, refer to [Available skip options] -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. +1. In the Cloudflare dashboard, go to the **Security rules** page. -2. Go to **Security** > **Security rules**. + -3. [Create a custom rule](/waf/custom-rules/create-dashboard/) by selecting **Create rule** > **Custom rules**, or edit an existing custom rule. +2. [Create a custom rule](/waf/custom-rules/create-dashboard/) by selecting **Create rule** > **Custom rules**, or edit an existing custom rule. -4. Define the rule name and the rule expression. +3. Define the rule name and the rule expression. -5. Under **Choose action**, select _Skip_ from the dropdown. +4. Under **Choose action**, select _Skip_ from the dropdown. ![Available Skip action options when configuring a custom rule](~/assets/images/waf/custom-rules/skip-action-options.png) -6. Configure the desired [skip options](/waf/custom-rules/skip/options/). +5. Configure the desired [skip options](/waf/custom-rules/skip/options/). -7. Save your changes. +6. Save your changes. diff --git a/src/content/docs/waf/detections/firewall-for-ai.mdx b/src/content/docs/waf/detections/firewall-for-ai.mdx index 3426df1153251f6..ece956cdc624333 100644 --- a/src/content/docs/waf/detections/firewall-for-ai.mdx +++ b/src/content/docs/waf/detections/firewall-for-ai.mdx @@ -17,6 +17,7 @@ import { Details, Steps, Type, + DashButton, } from "~/components"; Firewall for AI is a detection that can help protect your services powered by large language models (LLMs) against abuse. This model-agnostic detection currently helps you do the following: @@ -45,8 +46,11 @@ Firewall for AI is only available in the new [application security dashboard](/s -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Detections**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Detection tools**. 3. Turn on **Firewall for AI**. diff --git a/src/content/docs/waf/detections/index.mdx b/src/content/docs/waf/detections/index.mdx index f377451e34a75fd..ec89f385621a2db 100644 --- a/src/content/docs/waf/detections/index.mdx +++ b/src/content/docs/waf/detections/index.mdx @@ -14,6 +14,7 @@ import { Tabs, TabItem, Steps, + DashButton, } from "~/components"; Traffic detections check incoming requests for malicious or potentially malicious activity. Each enabled detection provides one or more scores — available in the [Security Analytics](/waf/analytics/security-analytics/) dashboard — that you can use in rule expressions. @@ -46,8 +47,11 @@ To turn on a traffic detection: -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Detections**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. Filter by **Detection tools**. 3. Turn on the desired detections. diff --git a/src/content/docs/waf/detections/leaked-credentials/get-started.mdx b/src/content/docs/waf/detections/leaked-credentials/get-started.mdx index 7f903e5e2d3eb0e..7239d780f315945 100644 --- a/src/content/docs/waf/detections/leaked-credentials/get-started.mdx +++ b/src/content/docs/waf/detections/leaked-credentials/get-started.mdx @@ -16,6 +16,7 @@ import { Steps, GlossaryTooltip, APIRequest, + DashButton, } from "~/components"; ## 1. Turn on the detection @@ -132,8 +133,11 @@ To check for leaked credentials in a way that is not covered by the default conf -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Detections**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Detection tools**. 3. Under **Leaked credential detection** > **Configurations**, select the edit icon. 4. Select **Add custom username and password location**. 5. In **Username location** and **Password location** (optional), enter expressions for obtaining the username and the password from the HTTP request. For example, you could use the following expressions: diff --git a/src/content/docs/waf/detections/malicious-uploads/get-started.mdx b/src/content/docs/waf/detections/malicious-uploads/get-started.mdx index a787e42f44da9d9..a734cfcbe15e808 100644 --- a/src/content/docs/waf/detections/malicious-uploads/get-started.mdx +++ b/src/content/docs/waf/detections/malicious-uploads/get-started.mdx @@ -15,6 +15,7 @@ import { Render, Steps, APIRequest, + DashButton, } from "~/components"; :::note @@ -37,8 +38,11 @@ WAF content scanning is available to customers on an Enterprise plan with a paid -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Detections**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Detection tools**. 3. Turn on **Malicious uploads detection**. @@ -143,8 +147,11 @@ To check uploaded content in a way that is not covered by the default configurat -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Detections**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Detection tools**. 3. Under **Malicious uploads detection** > **Configurations**, select the edit icon. 4. Select **Add content location**. 5. In **Content location**, enter your custom scan expression. For example: diff --git a/src/content/docs/waf/get-started.mdx b/src/content/docs/waf/get-started.mdx index ed82d9c5afd7eda..3e45441013ffffc 100644 --- a/src/content/docs/waf/get-started.mdx +++ b/src/content/docs/waf/get-started.mdx @@ -5,7 +5,15 @@ sidebar: order: 2 --- -import { Stream, Details, GlossaryTooltip, Tabs, TabItem, Steps } from "~/components"; +import { + Stream, + Details, + GlossaryTooltip, + Tabs, + TabItem, + Steps, + DashButton, +} from "~/components"; The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web and API requests and filters undesired traffic based on sets of rules called rulesets. @@ -18,9 +26,9 @@ This guide focuses on configuring WAF for individual domains, known as ## Before you begin @@ -47,8 +55,11 @@ The [Cloudflare Managed Ruleset](/waf/managed-rules/reference/cloudflare-managed -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Web application exploits**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Web application exploits**. 3. Turn on **Cloudflare managed ruleset**. @@ -144,8 +155,13 @@ The Cloudflare OWASP Core Ruleset is prone to false positives and offers only ma -1. Go to your domain > **Security** > **Settings** and filter by **Web application exploits**. -2. Turn on **OWASP Core**.
+1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Web application exploits**. + +3. Turn on **OWASP Core**.
This will deploy the Cloudflare OWASP Core Ruleset with the default configuration: paranoia level = _PL1_ and score threshold = _Medium - 40 and higher_. diff --git a/src/content/docs/waf/managed-rules/check-for-exposed-credentials/upgrade-to-leaked-credentials-detection.mdx b/src/content/docs/waf/managed-rules/check-for-exposed-credentials/upgrade-to-leaked-credentials-detection.mdx index 760e3f0c312f92e..808ad06b1192d9c 100644 --- a/src/content/docs/waf/managed-rules/check-for-exposed-credentials/upgrade-to-leaked-credentials-detection.mdx +++ b/src/content/docs/waf/managed-rules/check-for-exposed-credentials/upgrade-to-leaked-credentials-detection.mdx @@ -5,7 +5,7 @@ sidebar: order: 10 --- -import { Render, Tabs, TabItem, Steps } from "~/components"; +import { Render, Tabs, TabItem, Steps, DashButton } from "~/components"; This guide describes the general steps to upgrade your [Exposed Credentials Check](/waf/managed-rules/check-for-exposed-credentials/) configuration to the new [leaked credentials detection](/waf/detections/leaked-credentials/). @@ -37,8 +37,11 @@ If you had deployed the Cloudflare Exposed Credentials Check managed ruleset: -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain. -2. Go to **Security** > **Security rules** and filter by **Managed rules**. +1. In the Cloudflare dashboard, go to the **Security rules** page. + + + +2. (Optional) Filter by **Managed rules**. 3. Edit the rule that executes the Cloudflare Exposed Credentials Check Ruleset and take note of the current configuration (namely the performed action). Next, delete (or turn off) that rule. diff --git a/src/content/docs/waf/managed-rules/deploy-zone-dashboard.mdx b/src/content/docs/waf/managed-rules/deploy-zone-dashboard.mdx index e88895f390dde7c..bc184f0d8332c50 100644 --- a/src/content/docs/waf/managed-rules/deploy-zone-dashboard.mdx +++ b/src/content/docs/waf/managed-rules/deploy-zone-dashboard.mdx @@ -9,7 +9,7 @@ head: content: Deploy a WAF managed ruleset in the dashboard --- -import { Render, Tabs, TabItem, Steps } from "~/components"; +import { Render, Tabs, TabItem, Steps, DashButton } from "~/components"; The instructions on this page will guide you through deploying and configuring a managed ruleset for a zone. @@ -39,9 +39,15 @@ This operation deploys the managed ruleset for the current zone, creating a new -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Web application exploits**. -3. Turn on the managed ruleset you want to deploy. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Web application exploits**. +3. Turn on the managed ruleset(s) you want to deploy: + - **Cloudflare managed ruleset** - Deploys the [Cloudflare Managed Ruleset](/waf/managed-rules/reference/cloudflare-managed-ruleset/). + - **OWASP Core** - Deploys the [Cloudflare OWASP Core Ruleset](/waf/managed-rules/reference/owasp-core-ruleset/). + - **Sensitive data detection** - Deploys the [Cloudflare Sensitive Data Detection](/waf/managed-rules/reference/sensitive-data-detection/) managed ruleset. @@ -63,8 +69,11 @@ This operation deploys the managed ruleset for the current zone, creating a new -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Web application exploits**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Web application exploits**. 3. Next to the managed ruleset you want to turn on or off, set the toggle to **On** or **Off**, respectively. @@ -114,11 +123,13 @@ To configure rule field values for all the rules in a managed ruleset: -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. +1. In the Cloudflare dashboard, go to the **Security rules** page. -2. Go to **Security** > **Security rules**. + -3. In the rules table, search for the managed ruleset you want to configure. Look for a rule with an _Execute_ action. At the top of the page, you can filter the rules to show **Managed rules** only. +2. (Optional) Filter by **Managed rules**. + +3. Search for the managed ruleset you want to configure. Look for a rule with an _Execute_ action. 4. Select the rule name (containing the name of the managed ruleset). @@ -198,9 +209,12 @@ You can browse the available rules in a managed ruleset and search for individua -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. -2. Go to **Security** > **Security rules**. -3. In the rules table, search for the managed ruleset you want to configure/browse. At the top of the page, you can filter the rules to show **Managed rules** only. +1. In the Cloudflare dashboard, go to the **Security rules** page. + + + +2. (Optional) Filter by **Managed rules**. +3. Search for the managed ruleset you want to configure. 4. Next to the managed ruleset deployment rule (execute rule) or exception (skip rule) you want to delete, select the three dots > **Delete** and confirm the operation. diff --git a/src/content/docs/waf/managed-rules/payload-logging/configure.mdx b/src/content/docs/waf/managed-rules/payload-logging/configure.mdx index d5f387578a41462..73e06c8f3fe10a6 100644 --- a/src/content/docs/waf/managed-rules/payload-logging/configure.mdx +++ b/src/content/docs/waf/managed-rules/payload-logging/configure.mdx @@ -9,7 +9,7 @@ head: content: Configure payload logging for a managed ruleset in the dashboard --- -import { Tabs, TabItem, Steps } from "~/components"; +import { Tabs, TabItem, Steps, DashButton } from "~/components"; :::note Only users with the [Super Administrator role](/fundamentals/manage-members/roles/) can configure payload logging and decrypt payloads in the Cloudflare dashboard. Other users can decrypt payloads if they have access to the logs and to the private key. @@ -48,11 +48,13 @@ Only users with the [Super Administrator role](/fundamentals/manage-members/role -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. +1. In the Cloudflare dashboard, go to the **Security rules** page. + + -2. Go to **Security** > **Security rules**. +2. (Optional) Filter by **Managed rules**. -3. In the rules table, search for the managed ruleset you want to configure. Look for a rule with an _Execute_ action. At the top of the page, you can filter the rules to show **Managed rules** only. +3. Search for the managed ruleset you want to configure. Look for a rule with an _Execute_ action. 4. Select the rule name (containing the name of the managed ruleset). diff --git a/src/content/docs/waf/managed-rules/payload-logging/view.mdx b/src/content/docs/waf/managed-rules/payload-logging/view.mdx index f30066bd42263e8..feeb988e6c368ee 100644 --- a/src/content/docs/waf/managed-rules/payload-logging/view.mdx +++ b/src/content/docs/waf/managed-rules/payload-logging/view.mdx @@ -5,15 +5,29 @@ sidebar: order: 3 --- -import { Steps } from "~/components"; +import { Steps, Tabs, TabItem, DashButton } from "~/components"; View the content of the matched rule payload in the dashboard by entering your private key. +{/* prettier-ignore-start */} + 1. Open [Security Events](/waf/analytics/security-events/): - - Old dashboard: Go to **Security** > **Events**. - - New security dashboard: Go to **Security** > **Analytics** > **Events** tab. + + + + - In the Cloudflare dashboard, go to **Security** > **Events**. + + + + 1. In the Cloudflare dashboard, go to the **Analytics** page. + + + + 2. Select the **Events** tab. + + 2. Under **Sampled logs**, expand the details of an event triggered by a rule whose managed ruleset has payload logging enabled. @@ -27,6 +41,8 @@ View the content of the matched rule payload in the dashboard by entering your p The private key is not sent to a Cloudflare server. The decryption occurs entirely in the browser. ::: +{/* prettier-ignore-end */} + If the private key you entered decrypts the encrypted payload successfully, the dashboard will show the name of the fields that matched and the matched string in clear text, along with some text appearing before and after the match. diff --git a/src/content/docs/waf/managed-rules/reference/sensitive-data-detection.mdx b/src/content/docs/waf/managed-rules/reference/sensitive-data-detection.mdx index 3b839dab1f8ce8a..0791555e98db2a9 100644 --- a/src/content/docs/waf/managed-rules/reference/sensitive-data-detection.mdx +++ b/src/content/docs/waf/managed-rules/reference/sensitive-data-detection.mdx @@ -5,7 +5,15 @@ sidebar: order: 5 --- -import { Render, RuleID, APIRequest, Tabs, TabItem, Steps } from "~/components"; +import { + Render, + RuleID, + APIRequest, + Tabs, + TabItem, + Steps, + DashButton, +} from "~/components"; :::note This feature requires an Enterprise plan with a paid add-on. @@ -48,8 +56,11 @@ To enable Cloudflare Sensitive Data Detection: -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Detections**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Detections tools**. 3. Turn on **Sensitive data detection**. diff --git a/src/content/docs/waf/managed-rules/waf-exceptions/define-dashboard.mdx b/src/content/docs/waf/managed-rules/waf-exceptions/define-dashboard.mdx index cc763ebd06aba56..627696fbba2a449 100644 --- a/src/content/docs/waf/managed-rules/waf-exceptions/define-dashboard.mdx +++ b/src/content/docs/waf/managed-rules/waf-exceptions/define-dashboard.mdx @@ -30,9 +30,11 @@ To add an exception at the zone level: -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. -2. Go to **Security** > **Security rules**. -3. Next to **Managed rules**, select **Create rule**. +1. In the Cloudflare dashboard, go to the **Security rules** page. + + + +2. Select **Create** > **Managed rules**. @@ -122,8 +124,11 @@ To delete an exception listed in the **Managed rules** tab, select the three dot -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. -2. Go to **Security** > **Security rules** and filter by **Managed Rules**. +1. In the Cloudflare dashboard, go to the **Security rules** page. + + + +2. (Optional) Filter by **Managed Rules**. 3. Find the exception you want to edit and select its name. Exceptions are rules listed with **Action** = **Skip**. 4. Once you have finished making changes, select **Save**.
Alternatively, to delete the exception, select **Delete exception**. diff --git a/src/content/docs/waf/rate-limiting-rules/create-zone-dashboard.mdx b/src/content/docs/waf/rate-limiting-rules/create-zone-dashboard.mdx index 752a2df9bcc6d47..451d957bad69997 100644 --- a/src/content/docs/waf/rate-limiting-rules/create-zone-dashboard.mdx +++ b/src/content/docs/waf/rate-limiting-rules/create-zone-dashboard.mdx @@ -10,7 +10,7 @@ head: content: Create a rate limiting rule in the dashboard --- -import { Render, Tabs, TabItem, Steps } from "~/components"; +import { Render, Tabs, TabItem, Steps, DashButton } from "~/components"; @@ -67,36 +67,36 @@ import { Render, Tabs, TabItem, Steps } from "~/components"; -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and zone. +1. In the Cloudflare dashboard, go to the **Security rules** page. -2. Go to **Security** > **Security rules**. + -3. To create a new empty rule, select **Create rule** > **Rate limiting rules**. To duplicate an existing rule, select the three dots next to it > **Duplicate**. +2. To create a new empty rule, select **Create rule** > **Rate limiting rules**. To duplicate an existing rule, select the three dots next to it > **Duplicate**. -4. +3. Enter a descriptive name for the rule in **Rule name**. ![The Create rate limiting rule page in the Cloudflare dashboard](~/assets/images/waf/custom-rules/rate-limiting-create.png) -5. In the **Field** drop-down, choose an HTTP property. For each request, the value of the property you choose for **Field** is compared to the value you specify for **Value** using the operator selected in **Operator**. +4. In the **Field** drop-down, choose an HTTP property. For each request, the value of the property you choose for **Field** is compared to the value you specify for **Value** using the operator selected in **Operator**. -6. (Optional) Under **Cache status**, disable **Also apply rate limiting to cached assets** to consider only the requests that reach the origin when determining the rate. +5. (Optional) Under **Cache status**, disable **Also apply rate limiting to cached assets** to consider only the requests that reach the origin when determining the rate. -7. Under **With the same characteristics**, add one or more characteristics that will define the request counters for rate limiting purposes. Each value combination will have its own counter to determine the rate. Refer to [How Cloudflare determines the request rate](/waf/rate-limiting-rules/request-rate/) for more information. +6. Under **With the same characteristics**, add one or more characteristics that will define the request counters for rate limiting purposes. Each value combination will have its own counter to determine the rate. Refer to [How Cloudflare determines the request rate](/waf/rate-limiting-rules/request-rate/) for more information. -8. (Optional) To define an expression that specifies the conditions for incrementing the rate counter, enable **Use custom counting expression** and set the expression. By default, the counting expression is the same as the rule expression. The counting expression can include [response fields](/ruleset-engine/rules-language/fields/reference/?field-category=Response). +7. (Optional) To define an expression that specifies the conditions for incrementing the rate counter, enable **Use custom counting expression** and set the expression. By default, the counting expression is the same as the rule expression. The counting expression can include [response fields](/ruleset-engine/rules-language/fields/reference/?field-category=Response). -9. Under **When rate exceeds**, define the maximum number of requests and the time period to consider when determining the rate. +8. Under **When rate exceeds**, define the maximum number of requests and the time period to consider when determining the rate. -10. Under **Then take action**, select the rule action from the **Choose action** drop-down list. For example, selecting _Block_ tells Cloudflare to refuse requests in the conditions you specified when the request limit is reached. +9. Under **Then take action**, select the rule action from the **Choose action** drop-down list. For example, selecting _Block_ tells Cloudflare to refuse requests in the conditions you specified when the request limit is reached. -11. (Optional) If you selected the _Block_ action, you can [configure a custom response](#configure-a-custom-response-for-blocked-requests) for requests exceeding the configured rate limit. +10. (Optional) If you selected the _Block_ action, you can [configure a custom response](#configure-a-custom-response-for-blocked-requests) for requests exceeding the configured rate limit. -12. Select the mitigation timeout in the **Duration** dropdown. This is the time period during which Cloudflare applies the select action once the rate is reached. +11. Select the mitigation timeout in the **Duration** dropdown. This is the time period during which Cloudflare applies the select action once the rate is reached. Enterprise customers with a paid add-on can [throttle requests](/waf/rate-limiting-rules/parameters/#with-the-following-behavior) instead of applying the configured action for a selected duration. To throttle requests, under **With the following behavior** select _Throttle requests over the maximum configured rate_. -13. To save and deploy your rule, select **Deploy**. If you are not ready to deploy your rule, select **Save as Draft**. +12. To save and deploy your rule, select **Deploy**. If you are not ready to deploy your rule, select **Save as Draft**. diff --git a/src/content/docs/waf/rate-limiting-rules/find-rate-limit.mdx b/src/content/docs/waf/rate-limiting-rules/find-rate-limit.mdx index 87602a59e3548b5..6a9b6441c31a542 100644 --- a/src/content/docs/waf/rate-limiting-rules/find-rate-limit.mdx +++ b/src/content/docs/waf/rate-limiting-rules/find-rate-limit.mdx @@ -8,7 +8,7 @@ head: content: Find an appropriate rate limit --- -import { Steps } from "~/components"; +import { Steps, DashButton } from "~/components"; The **Request rate analysis** tab in [Security Analytics](/waf/analytics/security-analytics/) displays data on the request rate for traffic matching the selected filters and time period. Use this tab to determine the most appropriate rate limit for incoming traffic matching the applied filters. @@ -18,7 +18,7 @@ The **Request rate analysis** tab is only available to Enterprise customers. ## User interface overview -The **Request rate analysis** tab is available at the zone level in **Security** > **Analytics**. +The **Request rate analysis** tab is available at the zone level in the **Analytics** page. ![Screenshot of the Request rate analysis tab in Security Analytics](~/assets/images/waf/rate-limit-analytics.png) @@ -42,17 +42,17 @@ For more information on how Cloudflare calculates the request rate of incoming t -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and zone. +1. In the Cloudflare dashboard, go to the **Analytics** page. -2. Go to **Security** > **Analytics**. + -3. In the **Traffic analysis** tab, select a specific time period: +2. In the **Traffic analysis** tab, select a specific time period: - To look at the regular rate distribution, specify a period with non-peak traffic. - To analyze the rate of offending visitors/bots, select a period corresponding to an attack. -4. Apply filters to analyze a particular situation in your application where you want to apply rate limiting (for example, filter by `/login` URL path). +3. Apply filters to analyze a particular situation in your application where you want to apply rate limiting (for example, filter by `/login` URL path). -5. (Optional) To focus on non-automated/human traffic, use the bot score quick filter in the sidebar. +4. (Optional) To focus on non-automated/human traffic, use the bot score quick filter in the sidebar. diff --git a/src/content/docs/waf/reference/legacy/firewall-rules-upgrade.mdx b/src/content/docs/waf/reference/legacy/firewall-rules-upgrade.mdx index 7178756c1533439..825cc3e9c94b75c 100644 --- a/src/content/docs/waf/reference/legacy/firewall-rules-upgrade.mdx +++ b/src/content/docs/waf/reference/legacy/firewall-rules-upgrade.mdx @@ -36,8 +36,6 @@ In WAF custom rules you can [customize the response of the _Block_ action](/waf/ The default block response is a Cloudflare standard HTML page. If you need to send a custom response for _Block_ actions, configure the custom rule to return a fixed response with a custom response code (403, by default) and a custom body (HTML, JSON, XML, or plain text). -To define a custom response for a single rule, go to **Security** > **WAF** > [**Custom rules**](https://dash.cloudflare.com/?to=/:account/:zone/security/waf/custom-rules), edit the custom rule, and fill in the block-related options. - :::note Custom block response configurations are not returned by the Firewall Rules API. You must use the [Rulesets API](/waf/custom-rules/create-api/#example-b) to manage this new feature. ::: diff --git a/src/content/docs/waf/reference/legacy/old-rate-limiting/index.mdx b/src/content/docs/waf/reference/legacy/old-rate-limiting/index.mdx index 7d6c51ea47561cd..43a2eb0423e699e 100644 --- a/src/content/docs/waf/reference/legacy/old-rate-limiting/index.mdx +++ b/src/content/docs/waf/reference/legacy/old-rate-limiting/index.mdx @@ -315,7 +315,7 @@ To configure **Bypass**: ## Analytics -View rate limiting analytics in **Analytics** > **Security**. Rate Limiting analytics uses solid lines to represent traffic that matches simulated requests and dotted lines to portray actual blocked requests. Logs generated by a rate limiting rule are only visible to Enterprise customers via [Cloudflare Logs](/logs/). +View rate limiting analytics for your zone in **Analytics & logs** > **Security**. Rate Limiting analytics uses solid lines to represent traffic that matches simulated requests and dotted lines to portray actual blocked requests. Logs generated by a rate limiting rule are only visible to Enterprise customers via [Cloudflare Logs](/logs/). Cloudflare returns an `HTTP 429` error for blocked requests. Details on blocked requests per location are provided to Enterprise customers under **Status codes** in the analytics dashboard available at **Analytics** > **Traffic**. diff --git a/src/content/docs/waf/reference/legacy/old-waf-managed-rules/upgrade.mdx b/src/content/docs/waf/reference/legacy/old-waf-managed-rules/upgrade.mdx index 2014beab02af664..749634274b6b27b 100644 --- a/src/content/docs/waf/reference/legacy/old-waf-managed-rules/upgrade.mdx +++ b/src/content/docs/waf/reference/legacy/old-waf-managed-rules/upgrade.mdx @@ -5,7 +5,7 @@ sidebar: order: 3 --- -import { GlossaryTooltip } from "~/components"; +import { GlossaryTooltip, DashButton } from "~/components"; On 2022-05-04, Cloudflare started the upgrade from the [previous version of WAF managed rules](/waf/reference/legacy/old-waf-managed-rules/) to the new [WAF Managed Rules](/waf/managed-rules/), allowing a first set of eligible zones to migrate. Currently, all zones can upgrade to WAF Managed Rules, including partner accounts. @@ -169,8 +169,15 @@ You can start the WAF upgrade in the Cloudflare dashboard or via API. 1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and zone. -2. If you are using the old dashboard, go to **Security** > **WAF** > **Managed rules** tab.
- If you are using the [new security dashboard](/security/), go **to Security** > **Security rules** instead and select **Go to upgrade your Managed rules**. +2. A) If you are using the old dashboard: + - Go to **Security** > **WAF** > **Managed rules** tab. + + B) If you are using the [new security dashboard](/security/): + 1. Go to the **Security rules** page. + + + + 2. Select **Go to upgrade your Managed rules**. If you are an Enterprise customer, the dashboard will show the following banner: diff --git a/src/content/docs/waf/reference/phases.mdx b/src/content/docs/waf/reference/phases.mdx index d58dc9ce0b1bce5..dbf63d89c4b3c1a 100644 --- a/src/content/docs/waf/reference/phases.mdx +++ b/src/content/docs/waf/reference/phases.mdx @@ -33,11 +33,11 @@ These phases exist both at the account level and at the zone level. Considering | Security feature | Scope | Phase | Ruleset kind | Location in the dashboard | | -------------------------------------------------------------- | ------- | ------------------------------- | ------------------------------------- | --------------------------------------------------------------------------------------------- | | [Custom rulesets](/waf/account/custom-rulesets/)
| Account | `http_request_firewall_custom` | `custom` (create)
`root` (deploy) | > **Custom rulesets** tab | -| [Custom rules](/waf/custom-rules/) | Zone | `http_request_firewall_custom` | `zone` | Your zone > **Security** > **Security rules** | +| [Custom rules](/waf/custom-rules/) | Zone | `http_request_firewall_custom` | `zone` | | | [Rate limiting rulesets](/waf/account/rate-limiting-rulesets/) | Account | `http_ratelimit` | `root` | > **Rate limiting rulesets** tab | -| [Rate limiting rules](/waf/rate-limiting-rules/) | Zone | `http_ratelimit` | `zone` | Your zone > **Security** > **Security rules** | +| [Rate limiting rules](/waf/rate-limiting-rules/) | Zone | `http_ratelimit` | `zone` | | | [Managed rulesets](/waf/account/managed-rulesets/) | Account | `http_request_firewall_managed` | `root` | > **Managed rulesets** tab | -| [Managed rules](/waf/managed-rules/) | Zone | `http_request_firewall_managed` | `zone` | Your zone > **Security** > **Security rules** | +| [Managed rules](/waf/managed-rules/) | Zone | `http_request_firewall_managed` | `zone` | | diff --git a/src/content/docs/waf/tools/browser-integrity-check.mdx b/src/content/docs/waf/tools/browser-integrity-check.mdx index 4f927fcfdb90171..1a2f9ab558969ea 100644 --- a/src/content/docs/waf/tools/browser-integrity-check.mdx +++ b/src/content/docs/waf/tools/browser-integrity-check.mdx @@ -4,7 +4,7 @@ source: https://support.cloudflare.com/hc/en-us/articles/200170086-Understanding title: Browser Integrity Check --- -import { Render, Tabs, TabItem, Steps } from "~/components"; +import { Render, Tabs, TabItem, Steps, DashButton } from "~/components"; @@ -31,10 +31,12 @@ To disable BIC globally for your zone: -1. Log into the [Cloudflare dashboard](https://dash.cloudflare.com). -2. Select your account and zone. -3. Go to **Security** > **Settings** and filter by **DDoS attacks**. -4. Turn off **Browser integrity check**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **DDoS attacks**. +3. Turn off **Browser integrity check**. diff --git a/src/content/docs/waf/tools/ip-access-rules/create.mdx b/src/content/docs/waf/tools/ip-access-rules/create.mdx index 3a3ac293044dc8d..8a26593fca24316 100644 --- a/src/content/docs/waf/tools/ip-access-rules/create.mdx +++ b/src/content/docs/waf/tools/ip-access-rules/create.mdx @@ -6,7 +6,7 @@ sidebar: label: Create a rule --- -import { TabItem, Tabs, Steps } from "~/components"; +import { TabItem, Tabs, Steps, DashButton } from "~/components"; :::tip[Recommendation: Use custom rules instead] Cloudflare recommends that you create [custom rules](/waf/custom-rules/) instead of IP Access rules to perform IP-based or geography-based blocking (geoblocking). @@ -38,19 +38,19 @@ IP Access Rules are only available in the new security dashboard if you have con -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. +1. In the Cloudflare dashboard, go to the **Security rules** page. -2. Go to **Security** > **Security rules**. + -3. Select **Create rule** > **IP access rules**. +2. Select **Create rule** > **IP access rules**. -4. Enter the following rule details: +3. Enter the following rule details: 1. For **IP, IP range, country name, or ASN**, enter an IP address, IP range, country code/name, or Autonomous System Number (ASN). For details, refer to [Parameters](/waf/tools/ip-access-rules/parameters/). 2. For **Action**, select an [action](/waf/tools/ip-access-rules/actions/). 3. For **Zone**, select whether the rule applies to the current website only or to all websites in the account. 4. (Optional) Enter a note for the rule (for example, `Payment Gateway`). -5. Select **Create**. +4. Select **Create**. diff --git a/src/content/docs/waf/tools/replace-insecure-js-libraries.mdx b/src/content/docs/waf/tools/replace-insecure-js-libraries.mdx index 75c4543508d7c3d..452013c978ffdf6 100644 --- a/src/content/docs/waf/tools/replace-insecure-js-libraries.mdx +++ b/src/content/docs/waf/tools/replace-insecure-js-libraries.mdx @@ -12,6 +12,7 @@ import { TabItem, Steps, APIRequest, + DashButton, } from "~/components"; This feature, when turned on, automatically rewrites URLs to external JavaScript libraries to point to Cloudflare-hosted libraries instead. This change improves security and performance, and reduces the risk of malicious code being injected. @@ -46,9 +47,11 @@ The feature is available in all Cloudflare plans, and is turned on by default on -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account and zone. -2. Go to **Security** > **Settings**. -3. Turn **Replace insecure JavaScript libraries** on or off. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. Turn **Replace insecure JavaScript libraries** on or off. diff --git a/src/content/docs/waf/tools/scrape-shield/email-address-obfuscation.mdx b/src/content/docs/waf/tools/scrape-shield/email-address-obfuscation.mdx index b487d7e85d2af88..de60153ab32aaf9 100644 --- a/src/content/docs/waf/tools/scrape-shield/email-address-obfuscation.mdx +++ b/src/content/docs/waf/tools/scrape-shield/email-address-obfuscation.mdx @@ -6,7 +6,7 @@ sidebar: order: 1 --- -import { Render, TabItem, Tabs, Steps } from "~/components"; +import { Render, TabItem, Tabs, Steps, DashButton } from "~/components"; By enabling Cloudflare Email Address Obfuscation, email addresses on your web page will be hidden from bots, while keeping them visible to humans. In fact, there are no visible changes to your website for visitors. @@ -30,10 +30,11 @@ To disable **Email Address Obfuscation** in the dashboard: -1. Log into the [Cloudflare dashboard](https://dash.cloudflare.com/login). -2. Select your account and website. -3. Go to **Scrape Shield**. -4. For **Email Address Obfuscation**, switch the toggle to **Off**. +1. In the Cloudflare dashboard, go to the **Scrape Shield** page. + + + +2. For **Email Address Obfuscation**, switch the toggle to **Off**. diff --git a/src/content/docs/waf/tools/scrape-shield/hotlink-protection.mdx b/src/content/docs/waf/tools/scrape-shield/hotlink-protection.mdx index d674cc86f0db864..879664251b1a8fb 100644 --- a/src/content/docs/waf/tools/scrape-shield/hotlink-protection.mdx +++ b/src/content/docs/waf/tools/scrape-shield/hotlink-protection.mdx @@ -6,13 +6,11 @@ sidebar: order: 3 --- -import { Render, TabItem, Tabs, Steps } from "~/components"; +import { Render, TabItem, Tabs, Steps, DashButton } from "~/components"; Hotlink Protection prevents your images from being used by other sites, which can reduce the bandwidth consumed by your [origin server](https://www.cloudflare.com/learning/cdn/glossary/origin-server/). -:::note The supported file extensions are `gif`, `ico`, `jpg`, `jpeg`, and `png`. -::: ## Background @@ -31,10 +29,11 @@ To enable **Hotlink Protection** in the dashboard: -1. Log into the [Cloudflare dashboard](https://dash.cloudflare.com/login). -2. Select your account and website. -3. Go to **Scrape Shield**. -4. For **Hotlink Protection**, switch the toggle to **On**. +1. In the Cloudflare dashboard, go to the **Scrape Shield** page. + + + +2. For **Hotlink Protection**, switch the toggle to **On**. diff --git a/src/content/docs/waf/tools/user-agent-blocking.mdx b/src/content/docs/waf/tools/user-agent-blocking.mdx index 10fd7a18a371b69..8c9762b46e3cd08 100644 --- a/src/content/docs/waf/tools/user-agent-blocking.mdx +++ b/src/content/docs/waf/tools/user-agent-blocking.mdx @@ -6,7 +6,14 @@ sidebar: order: 3 --- -import { FeatureTable, TabItem, Tabs, Steps, APIRequest } from "~/components"; +import { + FeatureTable, + TabItem, + Tabs, + Steps, + APIRequest, + DashButton, +} from "~/components"; User Agent Blocking allows you to block specific browser or web application [`User-Agent` request headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/User-Agent). User agent rules apply to the entire domain instead of individual subdomains. @@ -61,9 +68,11 @@ User Agent Blocking is only available in the new security dashboard if you have -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account and domain. +1. In the Cloudflare dashboard, go to the **Security rules** page. + + -2. Go to **Security** > **Security rules**, and select **Create rule** > **User agent rules**. +2. Select **Create rule** > **User agent rules**. 3. Enter a descriptive name for the rule in **Name/Description**. diff --git a/src/content/docs/waf/tools/zone-lockdown.mdx b/src/content/docs/waf/tools/zone-lockdown.mdx index 88eb39aa0fa5d6d..391188bb4a3b8ba 100644 --- a/src/content/docs/waf/tools/zone-lockdown.mdx +++ b/src/content/docs/waf/tools/zone-lockdown.mdx @@ -6,7 +6,14 @@ sidebar: order: 4 --- -import { FeatureTable, TabItem, Tabs, Steps, APIRequest } from "~/components"; +import { + FeatureTable, + TabItem, + Tabs, + Steps, + APIRequest, + DashButton, +} from "~/components"; Zone Lockdown specifies a list of one or more IP addresses, CIDR ranges, or networks that are the only IPs allowed to access a domain, subdomain, or URL. You can configure multiple destinations, including IPv4/IPv6 addresses, in a single zone lockdown rule. @@ -64,9 +71,11 @@ Zone Lockdown is only available in the new security dashboard if you have config -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select your account and domain. +1. In the Cloudflare dashboard, go to the **Security rules** page. + + -2. Go to **Security** > **Security rules**, and select **Create rule** > **Zone lockdown rules**. +2. Select **Create rule** > **Zone lockdown rules**. 3. Enter a descriptive name for the rule in **Name**. diff --git a/src/content/partials/waf/leaked-credentials-detection-enable.mdx b/src/content/partials/waf/leaked-credentials-detection-enable.mdx index b47d9cbcff97332..4b3e8aa659d022d 100644 --- a/src/content/partials/waf/leaked-credentials-detection-enable.mdx +++ b/src/content/partials/waf/leaked-credentials-detection-enable.mdx @@ -2,7 +2,14 @@ {} --- -import { TabItem, Tabs, Render, APIRequest, Steps } from "~/components"; +import { + TabItem, + Tabs, + Render, + APIRequest, + Steps, + DashButton, +} from "~/components"; On Free plans, the leaked credentials detection is enabled by default, and no action is required. On paid plans, you can turn on the detection in the Cloudflare dashboard, via API, or using Terraform. @@ -20,8 +27,11 @@ On Free plans, the leaked credentials detection is enabled by default, and no ac -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. -2. Go to **Security** > **Settings** and filter by **Detections**. +1. In the Cloudflare dashboard, go to the Security **Settings** page. + + + +2. (Optional) Filter by **Detection tools**. 3. Turn on **Leaked credential detection**. diff --git a/src/content/partials/waf/managed-rules-browse-zone-new-nav.mdx b/src/content/partials/waf/managed-rules-browse-zone-new-nav.mdx index 16747da39d3d976..104552aa0a39db5 100644 --- a/src/content/partials/waf/managed-rules-browse-zone-new-nav.mdx +++ b/src/content/partials/waf/managed-rules-browse-zone-new-nav.mdx @@ -2,15 +2,17 @@ {} --- -import { Steps } from "~/components"; +import { Steps, DashButton } from "~/components"; -1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com), and select your account and domain. +1. In the Cloudflare dashboard, go to the **Security rules** page. -2. Go to **Security** > **Security rules**. + -3. In the rules table, search for the managed ruleset you want to configure/browse. Look for a rule with an _Execute_ action. At the top of the page, you can filter the rules to show **Managed rules** only. +2. (Optional) Filter by **Managed rules**. + +3. Search for the managed ruleset you want to configure/browse. Look for a rule with an _Execute_ action. 4. Select the rule name (containing the name of the managed ruleset), and then select **Browse rules**.