Cloudflare WAF Baseline Ruleset

Cloudflare WAF Baseline Ruleset

A production-hardened Terraform configuration that applies a comprehensive WAF ruleset to any Cloudflare zone. Covers the OWASP Top 10, blocks bad bots, rate-limits abusive clients, and adds custom rules tuned to reduce false positives on real application traffic.

Rulesets Applied

• Cloudflare Managed Ruleset — Cloudflare-maintained rules updated continuously; configured in block mode with paranoia level 2
• OWASP Core Rule Set — anomaly scoring mode, threshold tuned to 60 (low false-positive profile), blocking SQL injection, XSS, path traversal, remote file inclusion, and scanner detection
• Bot Management — blocks verified bad bots; allows verified good bots (Googlebot, Bingbot) via Cloudflare-maintained allowlist; human score challenge for unverified automated traffic
• Rate Limiting — per-IP rules: 100 req/10s on API paths (/api/*), 20 req/10s on login endpoints (/login, /auth, /wp-login), 5 req/min on password reset paths
• Custom Rules — blocks common exploit paths (/.env, /xmlrpc.php, /.git), User-Agent pattern blocking for known scanners, country-based challenge for high-risk regions (configurable)

Developer Experience

All rules are in Terraform HCL. A terraform.tfvars.example documents every variable. A dry-run workspace uses log mode instead of block — deploy to dry-run first, review the Cloudflare firewall events dashboard for 48 hours, then promote to production.

What You Get

• main.tf, variables.tf, outputs.tf — Terraform root module
• terraform.tfvars.example — all tunable parameters documented
• modules/rate-limiting/ — reusable rate limit rule module
• README.md — deployment guide, dry-run workflow, and false-positive tuning

Requirements

Cloudflare Pro plan or higher (WAF and rate limiting require Pro). Cloudflare API token with Zone WAF edit permissions. Terraform 1.5+.