` and set the rule sensitivity to `low`. All other rules use the default sensitivity defined by Cloudflare.
-
-
-
-
diff --git a/src/content/docs/ruleset-engine/managed-rulesets/override-examples/override-ruleset-tag-rule.mdx b/src/content/docs/ruleset-engine/managed-rulesets/override-examples/override-ruleset-tag-rule.mdx
index a7d93075fcbbc8a..5adea39934af78e 100644
--- a/src/content/docs/ruleset-engine/managed-rulesets/override-examples/override-ruleset-tag-rule.mdx
+++ b/src/content/docs/ruleset-engine/managed-rulesets/override-examples/override-ruleset-tag-rule.mdx
@@ -5,7 +5,7 @@ sidebar:
order: 5
---
-import { Details, APIRequest } from "~/components";
+import { Details, APIRequest, Render } from "~/components";
Customize the execution of managed rulesets with a combination of ruleset overrides, tag overrides, and rule overrides in your phase entry point ruleset.
@@ -14,14 +14,14 @@ Customize the execution of managed rulesets with a combination of ruleset overri
3. [Configure a tag override](/ruleset-engine/managed-rulesets/override-managed-ruleset/) that sets an action for rules with a given tag.
4. [Configure a rule override](/ruleset-engine/managed-rulesets/override-managed-ruleset/) that sets an action for the rules you want to execute.
-The request below uses the [Update a zone entry point ruleset](/ruleset-engine/rulesets-api/update/) operation to execute the following in a single `PUT` request:
+## Zone-level example
+
+This example uses the [Update a zone entry point ruleset](/ruleset-engine/rulesets-api/update/) operation to execute the following in a single `PUT` request:
- Add a rule to the `http_request_firewall_managed` phase entry point ruleset that executes a managed ruleset.
- Use category overrides to enable rules with `wordpress` and `drupal` tags and set their actions to `log`.
- Add a rule override that enables a single rule.
-
-
In this example:
- `"id": ""` defines the managed ruleset to execute for requests addressed to a zone (`$ZONE_ID`).
@@ -70,9 +70,13 @@ In this example:
}}
/>
-
+## Account-level example
-
+This example uses the [Update an account entry point ruleset](/ruleset-engine/rulesets-api/update/) operation to execute the following in a single `PUT` request:
+
+- Add a rule to the `http_request_firewall_managed` phase entry point ruleset that executes a managed ruleset for the zone `example.com`.
+- Use category overrides to enable rules with `wordpress` and `drupal` tags and set their actions to `log`.
+- Add a rule override that enables a single rule.
In this example:
@@ -81,6 +85,8 @@ In this example:
- `"categories": [{"category": "wordpress", "action": "log", "enabled": true}, {"category": "drupal", "action": "log", "enabled": true}]` defines an override at the tag level to enable rules tagged with `wordpress` or `drupal` and sets their action to `log`.
- `"rules": [{"id": "", "action": "block", "enabled": true}]` defines an override at the rule level that enables one individual rule and sets the action to `block`.
+
+
-
-
diff --git a/src/content/docs/ruleset-engine/rules-language/actions.mdx b/src/content/docs/ruleset-engine/rules-language/actions.mdx
index 60228376c2dc850..4cae7c00c46dfb2 100644
--- a/src/content/docs/ruleset-engine/rules-language/actions.mdx
+++ b/src/content/docs/ruleset-engine/rules-language/actions.mdx
@@ -92,6 +92,9 @@ The available actions depend on the [phase](/ruleset-engine/about/phases/) where
Matching requests are denied access to the site.
+ Depending on the Cloudflare product performing the block action, the HTTP status code can be 403 (most security features) or 429 (for example, rate limiting rules).
+ Customers on paid plans can customize the HTML error page displayed to website visitors due to the block action. Refer to Error Pages for more information.
+ Customers in Pro plans and above can customize the response (HTML, JSON, XML, or plain text) and the response status code for each custom rule or rate limiting rule that triggers a block action.
|
Yes |
@@ -265,7 +268,7 @@ The available actions depend on the [phase](/ruleset-engine/about/phases/) where
No |
-
+
Set Cache Settings
@@ -277,7 +280,7 @@ The available actions depend on the [phase](/ruleset-engine/about/phases/) where
Cache Rules allows you to customize cache settings on Cloudflare.
- Only available for Cache Rules, in the http_request_cache_settings phase.
+ Only available for Cache Rules, in the http_request_cache_settings phase.
In the Cloudflare dashboard, this action is not listed in action selection dropdowns. To use this action, create a cache rule.
@@ -285,6 +288,46 @@ The available actions depend on the [phase](/ruleset-engine/about/phases/) where
|
No |
+
+
+ Serve Error
+
+ API value:
+ serve_error
+ |
+
+
+ Serves error content to the website visitor, according to the custom error rule configuration.
+
+
+ Only available for Custom Error Rules, in the http_custom_errors phase.
+
+
+ In the Cloudflare dashboard, this action is not listed in action selection dropdowns. To use this action, create a custom error rule.
+
+ |
+ Yes |
+
+
+
+ Log custom field
+
+ API value:
+ log_custom_field
+ |
+
+
+ Configures custom fields for Logpush jobs in a zone.
+
+
+ Only available for custom fields, in the http_log_custom_fields phase.
+
+
+ In the Cloudflare dashboard, this action is not listed in action selection dropdowns. To use this action, configure custom log fields for Logpush jobs.
+
+ |
+ Yes |
+
diff --git a/src/content/docs/ruleset-engine/rules-language/operators.mdx b/src/content/docs/ruleset-engine/rules-language/operators.mdx
index f4dfae71bce10cf..5ab14d8b8de7cde 100644
--- a/src/content/docs/ruleset-engine/rules-language/operators.mdx
+++ b/src/content/docs/ruleset-engine/rules-language/operators.mdx
@@ -221,7 +221,7 @@ String comparison in rule expressions is case-sensitive. To account for possible
lower(http.request.uri.path) contains "/wp-login.php"
```
-Wildcard matching is only supported with the `wildcard` and `strict wildcard` operators, and regular expression matching is only supported with the `matches` operator.
+[Wildcard matching](#wildcard-matching) is only supported with the `wildcard` and `strict wildcard` operators, and [regular expression matching](#regular-expression-matching) is only supported with the `matches` operator.
### Wildcard matching
@@ -262,6 +262,8 @@ http.request.full_uri wildcard "*.example.com/*/page.html"
# - https://sub.example.com/a/ ('page.html' is missing)
```
+Slashes (`/`) have no special meaning in wildcard matches. In this example, the second `*` metacharacter in the expression `http.request.full_uri wildcard "*.example.com/*/page.html"` matched `folder`, `team`, and `team/subteam`.
+
diff --git a/src/content/docs/ruleset-engine/rulesets-api/json-object.mdx b/src/content/docs/ruleset-engine/rulesets-api/json-object.mdx
index 8190115b6a85e6b..c92d73e8afc2fff 100644
--- a/src/content/docs/ruleset-engine/rulesets-api/json-object.mdx
+++ b/src/content/docs/ruleset-engine/rulesets-api/json-object.mdx
@@ -39,33 +39,27 @@ A fully populated ruleset object has the following JSON structure.
The ruleset object has the following properties:
- `id`
-
- A 32-character UUIDv4 string that represents the unique Cloudflare-generated identifier for a given version of a ruleset.
- Unique, read-only.
- `name`
-
- A human-readable name for the ruleset.
- The name is immutable. You cannot change the name over the lifetime of the ruleset.
- `description`
-
- Optional description for the ruleset.
- You can change the description over the lifetime of the ruleset.
- `kind`
-
- The kind of ruleset the JSON object represents.
- One of `root`, `zone`, `managed`, `custom`.
- `kind` is immutable.
- `version`
-
- The version of the ruleset.
- Read-only value starting at `1` and incremented by `1` each time the ruleset is modified.
- `rules`
-
- A list of rules to include in the ruleset. Refer to [Rule object structure and properties](/ruleset-engine/rulesets-api/json-object/#rule-object-structure-and-properties) for details.
- `last_updated`
@@ -80,10 +74,15 @@ A fully populated rule JSON object has the following structure:
{
"id": "fdb0dd271f3f40b19679cc5d91396024",
"version": "2",
+ "ref": "[",
+ "description": "",
"action": "block",
- "categories": ["wordpress"],
+ "action_parameters": [
+ // action parameters vary according to the action
+ ],
+ "categories": ["", ""],
"expression": "cf.zone.name eq \"example.com\"",
- "last_updated": "2022-07-20T10:44:29.124515Z",
+ "last_updated": "2025-07-20T10:44:29.124515Z",
"enabled": true
}
```
@@ -91,33 +90,38 @@ A fully populated rule JSON object has the following structure:
The JSON object properties for a rule are defined as follows:
- `id`
-
- A 32-character UUIDv4 string that represents the unique Cloudflare-generated identifier for a given version of a rule.
- Unique, read-only.
- `version`
-
- The version of the rule.
- Read-only value starting at `1` and incremented by `1` each time the rule is modified.
- Changing the order of a rule in a ruleset does not change its version.
-- `action`
+- `ref`
+ - A user-defined external identifier that must be unique for each rule in a ruleset.
+ - Use this field in your Terraform configuration to prevent Terraform from recreating the rule on changes. Refer to [How to keep the same rule ID between modifications](/terraform/troubleshooting/rule-id-changes/#how-to-keep-the-same-rule-id-between-modifications) for more information.
+
+- `description`
+ - A descriptive name of the rule.
+- `action`
- Defines what happens when there is a match for the rule expression.
- - The available actions depend on the [phase](/ruleset-engine/about/phases/) where the rule's ruleset is executed.
+ - The available [actions](/ruleset-engine/rules-language/actions/) depend on the [phase](/ruleset-engine/about/phases/) where the rule's ruleset is executed.
-- `categories`
+- `action_parameters`
+ - One or more parameters configuring the rule action.
+ - The exact properties vary according to the action. Refer to each Cloudflare product's API instructions for more information.
+- `categories`
- Tags associated with the current rule. You can define overrides that affect rules with a given tag.
- Read-only. Only available in [WAF Managed Rules](/waf/managed-rules/) and [DDoS managed rulesets](/ddos-protection/managed-rulesets/).
- `expression`
-
- Criteria defining when there is a match for the current rule.
- The fields and functions you can use in a rule expression depend on the phase where the rule's ruleset is executed.
- `last_updated`
-
- The time (UTC) when the rule was last updated in ISO 8601 format: `YYYY-MM-DDThh:mm:ss.TZD`.
- Read-only.
diff --git a/src/content/fields/index.yaml b/src/content/fields/index.yaml
index 5a04fe6ff4467fc..35082f002928aa0 100644
--- a/src/content/fields/index.yaml
+++ b/src/content/fields/index.yaml
@@ -1958,6 +1958,8 @@ entries:
categories: [Response]
keywords: [response]
summary: The HTTP status code returned to the client, either set by a Cloudflare product or returned by the origin server.
+ description: |-
+ **Note**: The availability of HTTP response fields depends on the exact Cloudflare feature and your Cloudflare plan.
example_value: |-
403
@@ -1972,6 +1974,8 @@ entries:
- **Decoding**: No decoding performed
- **Whitespace**: Preserved
- **Non-ASCII**: Preserved
+
+ **Note**: The availability of HTTP response fields depends on the exact Cloudflare feature and your Cloudflare plan.
example_value: |-
{"server": ["nginx"]}
example_block: |-
@@ -1992,6 +1996,8 @@ entries:
- **Decoding**: No decoding performed
- **Whitespace**: Preserved
- **Non-ASCII**: Preserved
+
+ **Note**: The availability of HTTP response fields depends on the exact Cloudflare feature and your Cloudflare plan.
example_value: |-
["content-type"]
example_block: |-
@@ -2012,6 +2018,8 @@ entries:
- **Decoding**: No decoding performed
- **Whitespace**: Preserved
- **Non-ASCII**: Preserved
+
+ **Note**: The availability of HTTP response fields depends on the exact Cloudflare feature and your Cloudflare plan.
example_value: |-
Example 1: ["application/json"]
Example 2: ["This header value is longer than 10 bytes"]
@@ -2041,6 +2049,7 @@ entries:
| `text/HTML` | `"text/html"` |
| `text/html; charset=utf-8; other=value` | `"text/html"` |
+ **Note**: The availability of HTTP response fields depends on the exact Cloudflare feature and your Cloudflare plan.
- name: cf.response.1xxx_code
data_type: Integer
categories: [Response]
diff --git a/src/content/partials/ruleset-engine/deploy-account-ruleset-requirement.mdx b/src/content/partials/ruleset-engine/deploy-account-ruleset-requirement.mdx
new file mode 100644
index 000000000000000..8d2fff9efbd783d
--- /dev/null
+++ b/src/content/partials/ruleset-engine/deploy-account-ruleset-requirement.mdx
@@ -0,0 +1,7 @@
+---
+{}
+---
+
+:::note
+At the account level, the rule expression of an `execute` rule must end with `and cf.zone.plan eq "ENT"` so that it only applies to zones on an Enterprise plan.
+:::
]