Page Rules WAF Off doesn't work
Hi friends, I have a zone on the Enterprise Plan, and previously we had some WAF Managed Rules. I recently migrated the zone to the new WAF, and the migration assistant had a few "generated from pagerule" entries that corresponded with some Page Rules I have that skip the WAF.
I erroneously believed these exceptions were not necessary because traffic hits Page Rules first before the WAF, and if a pagerule exists to skip the WAF, then ostensibly traffic would never hit the WAF downstream. So I removed the exceptions and carried on...
However this apparently isn't the case, and has been known for a while since the new WAF release (see https://community.cloudflare.com/t/bypass-waf-rule-inbound-anomaly-score-exceeded/278826/2)
My question remains: in order to skip the WAF, is the best practice here on out to skip in the WAF and the relevant page rules are now deprecated, or is it the other way around but the WAF exceptions are a temprary mitigation until this long-standing misunderestanding is fixed?
I erroneously believed these exceptions were not necessary because traffic hits Page Rules first before the WAF, and if a pagerule exists to skip the WAF, then ostensibly traffic would never hit the WAF downstream. So I removed the exceptions and carried on...
However this apparently isn't the case, and has been known for a while since the new WAF release (see https://community.cloudflare.com/t/bypass-waf-rule-inbound-anomaly-score-exceeded/278826/2)
My question remains: in order to skip the WAF, is the best practice here on out to skip in the WAF and the relevant page rules are now deprecated, or is it the other way around but the WAF exceptions are a temprary mitigation until this long-standing misunderestanding is fixed?
Welcome to the official Cloudflare Developers server. Here you can ask for help and stay updated with the latest news
85,042Members
Resources
Similar Threads
Was this page helpful?
