Cloudflare custom rules let you control how requests are handled before they reach your origin.
This guide explains how to create Cloudflare custom rule configurations that are practical, measurable, and easy to maintain.
What a Cloudflare custom rule does
A Cloudflare custom rule is a conditional policy that matches traffic based on request data such as IP address, country, URI path, hostname, user agent, headers, cookies, or query strings.
In Cloudflare’s rules engine, these conditions are commonly used to block, challenge, skip, redirect, rate limit, or otherwise shape traffic.
Custom rules are useful because they let you target specific patterns instead of applying broad protection.
That improves security and reduces unnecessary friction for legitimate visitors.
Where custom rules fit in Cloudflare
Cloudflare organizes traffic controls into rule-based products, including WAF custom rules, firewall rules, rate limiting, redirects, cache rules, configuration rules, and origin rules.
The exact interface and available actions depend on your plan and which rules product you are using.
For most site owners, the most common use cases are:
- Blocking abusive countries, bots, or IP ranges
- Challenging suspicious logins or checkout traffic
- Skipping security checks for trusted internal tools
- Redirecting old URLs to new destinations
- Applying different cache or origin behavior to specific paths
How to create Cloudflare custom rule
The general workflow is the same whether you are creating a security rule or a traffic rule.
You define a condition, test it, choose an action, and then monitor results.
1. Open the relevant rules section
Sign in to the Cloudflare dashboard and select the correct zone.
Then open the section that matches your goal, such as Security, WAF, Rules, Redirect Rules, or Cache Rules.
If you are creating a security policy, you will usually work inside the custom rules area of the firewall or WAF interface.
2. Start a new rule
Choose the option to create a new rule.
Cloudflare typically provides a visual builder and a field for the expression.
The builder is helpful for common conditions, while the expression editor offers more precision and flexibility.
3. Define the match condition
Use Cloudflare expressions to target the traffic you want.
A rule can be based on one condition or several combined with logical operators such as and, or, and not.
Examples of common fields include:
- http.request.uri.path for URL paths
- http.request.full_uri for full request URLs
- ip.src for client IP address
- http.user_agent for browser or bot identification
- cf.client.bot for bot-related logic where available
- http.host for hostname matching
- http.request.headers for header-based decisions
For example, you may want to match traffic to /wp-login.php from outside your office network, or challenge requests that contain suspicious patterns in the user agent.
4. Choose the action
After defining the condition, select what Cloudflare should do when the rule matches.
Common actions include:
- Block to stop the request
- Managed Challenge to verify the visitor with minimal friction
- JS Challenge in older configurations where supported
- Skip to exclude certain requests from security processing
- Redirect to send users to another URL
- Allow or equivalent trusted-traffic handling, depending on the product
The best action depends on the risk level.
For uncertain traffic, a challenge is often safer than an immediate block.
5. Test in a safe mode
Before enforcing a rule, use Cloudflare tools such as preview, simulation, or logging features if available in your plan.
Testing helps confirm the match logic without accidentally disrupting real users.
Check whether the rule matches only the intended traffic and whether it conflicts with existing firewall settings, page rules, redirect rules, or origin logic.
6. Deploy and monitor
Once the rule is live, monitor event logs, analytics, and security events.
Look for false positives, unexpected traffic spikes, and blocked legitimate users.
Fine-tune the expression if you see problems.
Examples of useful Cloudflare custom rules
Real-world rule design is easier when you think in traffic patterns rather than abstract settings.
These examples show common ways organizations use Cloudflare rules.
Protecting admin panels
Many teams restrict access to admin paths such as /admin or /wp-admin.
A rule can challenge or block traffic to these paths unless the request comes from a known office IP range or VPN range.
Reducing bot abuse
Sites that receive credential stuffing, scraping, or fake signups often create rules based on request frequency, user agent anomalies, or suspicious geographies.
Cloudflare Bot Management and custom logic can work together to reduce automated abuse.
Separating internal traffic
Organizations often need to exclude monitoring tools, staging systems, or internal APIs from standard security checks.
A skip rule can reduce noise while preserving protection for public traffic.
Controlling country-specific access
If your business only serves certain regions, you can match requests by country and apply a block or challenge to the rest.
This is common for compliance, licensing, and fraud reduction.
Redirecting old paths
When content moves, redirect rules help preserve SEO value and user experience.
A custom rule can send visitors from deprecated URLs to current ones with a 301 redirect.
Best practices for rule design
Clear rule design prevents accidental outages and makes long-term maintenance easier.
Keep rules narrow, named, and documented.
- Use descriptive names so future admins know why the rule exists
- Start with challenge before block when the traffic pattern is not fully trusted
- Avoid overlapping rules that produce inconsistent outcomes
- Document business reasons for every production rule
- Review rules regularly as traffic patterns, bot behavior, and application paths change
- Prefer specific conditions over broad matches that affect too many requests
If you manage multiple applications, create separate rulesets for each hostname or path group.
That structure makes troubleshooting much easier.
Common mistakes to avoid
Most rule issues come from overly broad conditions, poor testing, or misunderstanding how Cloudflare evaluates requests.
Avoid these common errors:
- Blocking a country or ASN without verifying legitimate users
- Matching only on user agent, which is easy to spoof
- Forgetting about API clients, mobile apps, and search engine crawlers
- Creating conflicting rules in different Cloudflare sections
- Skipping tests and discovering false positives after deployment
It is also important to understand your application architecture.
For example, if your origin uses a reverse proxy, load balancer, or multi-tenant routing, the path or host values may need careful inspection before a rule is finalized.
How to verify a rule is working
After deployment, confirm that the rule is performing as intended.
Cloudflare security events and logs can show whether a rule matched, what action was taken, and which requests were affected.
Useful validation steps include:
- Test from a known allowed location
- Test from a known blocked or challenged location
- Check analytics for drops in abusive requests
- Review false-positive reports from users or support teams
- Adjust the expression if the rule is too broad or too narrow
When possible, combine Cloudflare data with origin logs, application logs, and SIEM monitoring.
That gives you a fuller picture of whether the rule is improving security without harming legitimate traffic.
When to use custom rules instead of code changes
Cloudflare custom rules are ideal when you need fast, centralized control at the edge.
They are especially valuable for temporary campaigns, security incidents, and traffic shaping that should not require application deployments.
Choose Cloudflare rules when you want:
- Immediate enforcement before traffic reaches the server
- Protection across multiple applications or subdomains
- Security logic managed outside application code
- Low-latency decisions at the edge
- Simple changes that non-developers can review
Use application code when the logic must be deeply tied to user state, database records, or app-specific workflows that Cloudflare cannot inspect directly.
Key terms to know before you start
Understanding a few Cloudflare terms will make rule creation much easier.
- Expression: the logical statement that defines matching conditions
- Action: the response Cloudflare takes when the expression matches
- Zone: the domain or site managed in Cloudflare
- Edge: Cloudflare’s distributed network where rules are enforced
- Ruleset: the collection of rules applied to a request flow
Once you know these basics, it becomes much simpler to create Cloudflare custom rule configurations that are accurate, auditable, and effective.