Security
WAF review
Score: 9/10Free managed rules, mostly easy, occasionally mysterious.
The breakdown explains the score. It is not an average. How to read these.
Last updated
The WAF is one of the platform’s best-value products. Managed rulesets are often updated the same day a CVE appears, and custom rules use the wirefilter expression language found elsewhere on the platform. Free plans get a useful baseline, while paid plans get the full rulesets.
Custom rules are the highlight. The expression builder is pleasant, and one rule can combine bot scores, ASNs, JA4 fingerprints, headers, and URI patterns. That can replace whole categories of application code.
It loses a point for debugging. Tracing why a legitimate request was challenged or blocked through Security Events can feel like archaeology, and false positives on webhook traffic have caught me more than once. Nothing else comes close for the price.
Status page incidents
Published under Firewall, plus incidents whose title names it.
- Last 3 years
- 45
- 7 from the title
- Major or critical
- 5
- Median time open
- 1.8 h
- Since September 2020
- 133
Counts what Cloudflare published, not what broke: time open is how long the status entry stayed open, and nothing before September 2020 is tracked at all. Incidents Cloudflare tagged against nothing but named in the title are counted too. The caveats in full.