Cloudflare WAF Expression Builder
Translate plain-English security requirements into Cloudflare Firewall Rule expressions. Defend login routes, challenge automated scraper ASNs, and safeguard AdSense monetization by exempting /ads.txt.
(http.request.uri.path contains "/api/" and ip.geoip.country ne "US" and not cf.client.bot)
Reserved banner container configured with strict Core Web Vitals CLS = 0 layout preservation.
Cloudflare Firewall Rules Language: Wireshark Filtering Syntax Explained
Cloudflare evaluates incoming HTTP requests using a high-performance filtering engine inspired by Wireshark display filters. Every rule consists of field identifiers, comparison operators, and values evaluated against the edge request context:
Geo & Network Fields
ip.geoip.country matches two-letter ISO-3166-1 alpha-2 country codes (or "T1" for Tor exit nodes). ip.geoip.asnum matches Autonomous System Numbers.
URI & Method Matchers
http.request.uri.path inspects the request path without query arguments. Use contains, starts_with, or eq for strict routing.
Bot & Threat Intelligence
cf.client.bot identifies verified search crawlers (Googlebot, Bingbot). Always prefix mitigation with and not cf.client.bot to protect SEO indexing!
Critical Best Practice: Exempting /ads.txt and Webhooks from Bot Mitigation
One of the most catastrophic errors website owners make when activating aggressive Cloudflare bot defense rules is challenging or blocking crawler requests to /ads.txt, /robots.txt, or third-party API webhook callbacks:
AdSense & Ad Exchange Crawlers
Google AdSense, Prebid demand partners, and programmatic exchanges crawl /ads.txt multiple times per day using automated headless user-agents that do not execute JavaScript challenges. If Cloudflare displays a Turnstile interstitial, the crawler records a "No ads.txt Found" error, causing ad demand and ad revenue to immediately drop to zero!
SaaS Webhooks (Stripe, GitHub, PayPal)
Payment gateways send HTTP POST payloads directly from their cloud servers to your webhook endpoints. These automated server-to-server calls cannot solve interactive CAPTCHAs. Always append an exemption clause such as and not http.request.uri.path starts_with "/api/webhooks/" to your custom rules.
Frequently Asked Questions (FAQ)
What is the difference between Managed Challenge and JS Challenge?
A JavaScript Challenge forces the client browser to execute a lightweight cryptographic calculation in the background. A Managed Challenge dynamically chooses between a seamless non-interactive browser validation and an interactive Cloudflare Turnstile checkbox depending on the visitor's real-time threat intelligence.
What ASNs belong to common cloud scraper hosting providers?
Common scraper datacenter ASNs include: AS14061 (DigitalOcean), AS16509 (Amazon AWS), AS16276 (OVHcloud), and AS24940 (Hetzner). Blocking these ASNs stops automated Python/Puppeteer scrapers without affecting genuine residential visitors.
How does Cloudflare calculate cf.threat_score?
The threat score ranges from 0 (clean, trustworthy IP) to 100 (high malicious threat). A score greater than 10 indicates the IP was recently seen participating in spam, credential stuffing, or DDoS attacks across Cloudflare's global network.
Can I use these expressions in Terraform?
Yes! Use the "Terraform (HCL)" tab above to export a copy-pasteable configuration for the official cloudflare/cloudflare Terraform provider to deploy your WAF rules across production environments programmatically.