Creating Your First WAF Rule

To create a custom WAF rule, use the + New Rule button on Console → WAF → [domain] → Rules. The rule engine works on a Field → Operator → Value pattern; no code required.

Your site is already protected

Before writing any rules, know this: every new domain comes with HEIMWALL Rules (managed attack signatures) and the Threat List (threat-intelligence IP deny list) enabled by default. Your custom rules are layered on top — you don’t build the baseline protection, you only fine-tune it. Details: Managed Rules.

How to add a rule

As an example, let’s block a specific IP address:

1. Open Console → WAF → [domain] → Rules and click + New Rule.

2. Give the rule a name (e.g. ip-block).

3. Build the condition: Field → IP Address (ip.src), Operator → equals (==), Value → the IP you want to block (203.0.113.42).

4. Choose Block as the action and save. The rule propagates to all edge servers instantly.

The logic of the rule is:

IF   ip.src == 203.0.113.42
THEN block

You can combine multiple conditions with Add Condition (AND) and Add Group (OR).

Test with log first

If you’re unsure about a new rule, choose the Log (observe only) action first: matches are recorded in the Access logs but no request is blocked. Watch the logs for a few hours, confirm there are no false positives, then switch the action to Block — a safe approach with no irreversible surprises.

Explore the rule engine

When you add a condition while building a rule, you can match on many fields — IP, country, bot score, HTTP headers and more. For the full list of fields, see Fields. The options used to compare them live in Operators, and the things you can do on a match (block, redirect, rate limit, etc.) in Actions. To see end to end how a rule is built, along with the syntax, visit Rule Engine Overview.

Rule examples

Blocking Foreign TrafficCountry-based restriction with ip.country — including search engine exemptions.

Protecting Your Admin PanelRestrict /admin access with an IP list + path condition.

Rate Limiting Your Login PageThe ratelimit action against brute force.

Blocking Bad BotsFiltering with bot score and categories.