A new Cloudflare Web Application Firewall
Mar 29, 2021Michael Tremante
Summary
Introduced a new WAF engine written in Rust, adopting the wirefilter syntax. This engine replaces the previous LuaJIT implementation and aims to improve performance, security, and scalability. The post details enhancements to the WAF UI for better rule browsing and configuration, including one-click deployment, filtering by status/action/tag, bulk editing, and a review screen for changes. Updated rulesets, including the OWASP Core Ruleset to v3.3, with improved false positive rates and new features like paranoia levels and rule tags. Introduced global configuration capabilities for account-wide WAF deployments and native versioning/rollback for rulesets.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack