Workflow: hardening a zone with the WAF

# Workflow: WAF hardening

## 1. Managed rulesets on

Enable the Cloudflare managed rulesets appropriate for your stack. They cover the OWASP-style basics; your custom rules cover your app's specifics. Know the execution order: custom rules, managed rules, Bot Fight Mode are separate phases.

## 2. Skip rules for known-good traffic first

Before adding blocks, add Skip rules for health checks, monitoring probes, partner webhooks, and office IPs. Skips must evaluate before the blocks they exempt: order them first.

## 3. Custom rules for your attack surface

Write narrow rules for your stack's known-bad patterns (admin paths, legacy endpoints, probe signatures). Name them by intent. Remember terminating actions stop evaluation: the first Block wins.

## 4. Rate limiting in Log mode

Add rate limits for auth endpoints and expensive APIs. Deploy in Log, use the request-rate analysis to pick thresholds, count failures (401s) rather than raw hits for login endpoints, then switch to block or challenge.

## 5. Tune from the events log

The Security events log shows every action and which rule fired. Weekly review in the first month: every false positive gets a narrower expression or a skip; every missed attack gets a new rule.

## Checklist

- Skips first, then specific blocks, then broad challenges.
- Log before enforce, for both custom rules and rate limits.
- Never disable the whole WAF to fix one rule.