CDN WAF & Security
Protect your websites with the built-in Web Application Firewall.
WAF Features
- OWASP Rules - Core Rule Set protection
- Custom Rules - Create your own rules
- Rate Limiting - Prevent abuse
- Bot Management - Block bad bots
- DDoS Protection - Layer 3/4/7 mitigation
Enable WAF
- Go to CDN → Domain → Security
- Toggle WAF to enabled
- Select protection level
Protection Levels
| Level | Description |
|---|---|
| Off | No WAF protection |
| Low | Block obvious attacks |
| Medium | Balanced protection |
| High | Maximum protection (may have false positives) |
Custom Rules
Create rules to block or allow specific traffic:
IF request.uri contains "/admin"
AND ip.src not in {office_ips}
THEN block
Rate Limiting
Prevent abuse with rate limits:
| Setting | Example |
|---|---|
| Requests per minute | 100 |
| Action | Challenge or Block |
| Bypass | Known good IPs |
Security Headers
Add security headers automatically:
- X-Frame-Options
- X-Content-Type-Options
- X-XSS-Protection
- Content-Security-Policy