Operators

An operator defines how a field is compared against a value in a condition: exact equality, list membership, or a substring search? Every condition follows the IF {field} {operator} {value} syntax, and the console only offers the operators that are valid for the selected field’s type.

The 14 operators fall into five groups:

Group	Operators	When to use
Equality	== !=	A single, exact value: one country, one method, an on/off signal
List membership	in not_in	Several accepted/rejected values for the same field
Text search	contains not_contains	The value may appear anywhere inside the field
Prefix / suffix	has_prefix has_suffix has_not_prefix has_not_suffix	The start/end of a path or URI — targeting directories and extensions
Numeric comparison	gt ge lt le	Thresholds and ranges on numeric fields like scores and status codes

String comparisons are case-sensitive: http.user_agent contains bot matches the lowercase bot inside Googlebot/2.1, but not BOT. Enter values in the field’s actual form — verified bot names, for example, are lowercase (googlebot, bingbot).

Quick reference

The In the console column is the label shown in the console menu; the Operator column is the technical name shown in the Rule Preview.

In the console	Operator	Example
equals	==	ip.country == TR
not equals	!=	http.request.method != GET
in list	in	ip.country in TR, DE, FR
not in list	not_in	ip.country not_in RU, CN
contains	contains	http.user_agent contains bot
does not contain	not_contains	http.host not_contains staging
starts with	has_prefix	http.request.base_uri has_prefix /api
ends with	has_suffix	http.request.base_uri has_suffix .php
does not start with	has_not_prefix	http.request.base_uri has_not_prefix /static
does not end with	has_not_suffix	http.request.base_uri has_not_suffix .js
greater than	gt	waf.bot_score gt 80
greater or equal	ge	waf.bot_score ge 60
less than	lt	waf.bot_score lt 20
less or equal	le	waf.bot_score le 40

---

Equality: == and !=

The most basic operators: does the field exactly match the given value (==) or not (!=)?

# Block a single country
IF   ip.country == RU
THEN block

# Tighten every method except GET
IF   http.request.method != GET
AND  http.request.base_uri has_prefix /api
THEN ratelimit 30/60s

# CAPTCHA for Tor exit nodes
IF   waf.client.tor == on
THEN captcha

With these selections in the console:

• Block a single country — Field Country · Operator equals · Value RU → Action Block
• Tighten every method except GET — Field HTTP Method · Operator not equals · Value GET AND Field Path (without query) · Operator starts with · Value /api → Action Rate Limit (30 requests / 60 s)
• CAPTCHA for Tor exit nodes — Field Tor · Operator equals · Value Yes → Action CAPTCHA

On/off signals like waf.client.bot, waf.client.vpn and waf.client.tor only accept the equality operators (==, !=); text and list operators are not offered for these fields.

A single IP ≠ an IP range

ip.src == 10.0.0.0/8 does not work — ip.src only accepts plain IPv4/IPv6 addresses. Use ip.prefix to target a CIDR block, or an IP list for many addresses.

List membership: in and not_in

Compares one field against several values at once: in is true when the field matches any entry, not_in when it matches none. Values are comma-separated, with a maximum of 256 values per list.

# Allow three countries, block the rest (two rules)
IF   ip.country in TR, DE, FR
THEN allow

IF   ip.country not_in TR, DE, FR
THEN block

# Block verified bots outside search and monitoring
IF   waf.client.bot == on
AND  waf.client.bot_category not_in search, monitoring
THEN block

With these selections in the console:

• Allow three countries — Field Country · Operator in list · Value TR, DE, FR → Action Allow
• Block the rest — Field Country · Operator not in list · Value TR, DE, FR → Action Block
• Block verified bots — Field Known Bot · Operator equals · Value Yes AND Field Bot Category · Operator not in list · Value search, monitoring → Action Block

You could reach the same result by chaining many == conditions with OR groups, but in is both more readable and costs a single condition. The ip.list field is a special case: it works only with in / not_in, and its value is the name of a list you defined under IP Lists.

Text search: contains and not_contains

Checks whether the given value appears anywhere inside the field’s content. This is the primary tool for User-Agent filtering, header presence checks and query parameter matching.

# Block a known attack tool
IF   http.user_agent contains sqlmap
THEN block

# Reject API requests without an API key header
IF   http.header not_contains X-Api-Key
AND  http.request.base_uri has_prefix /api
THEN block

With these selections in the console:

• Block a known attack tool — Field User Agent · Operator contains · Value sqlmap → Action Block
• Reject requests without an API key — Field Header · Operator does not contain · Value X-Api-Key AND Field Path (without query) · Operator starts with · Value /api → Action Block

Short values match broadly

http.user_agent contains bot also catches most verified bots, including Googlebot and Bingbot — all of these User-Agents carry the lowercase bot substring (Googlebot/2.1). Always place an exemption rule like waf.client.bot_category in search, monitoring → allow above such a broad block; since allow wins, legitimate bots stay unaffected.

Prefix and suffix: has_prefix, has_suffix and their negations

Targets the start (has_prefix) or the end (has_suffix) of a field. The difference from contains is position: a /admin prefix condition does not match the path /blog/admin-tips. The negated forms (has_not_prefix, has_not_suffix) carve an area out of a rule.

# Country restriction on the admin panel
IF   http.request.base_uri has_prefix /admin
AND  ip.country != TR
THEN block

# Block .php requests (on a site that doesn't use PHP)
IF   http.request.base_uri has_suffix .php
THEN block

# Rate limit everything except static files
IF   http.request.base_uri has_not_prefix /static
THEN ratelimit 100/60s

With these selections in the console:

• Country restriction on the admin panel — Field Path (without query) · Operator starts with · Value /admin AND Field Country · Operator not equals · Value TR → Action Block
• Block .php requests — Field Path (without query) · Operator ends with · Value .php → Action Block
• Rate limit everything except static files — Field Path (without query) · Operator does not start with · Value /static → Action Rate Limit (100 requests / 60 s)

Use base_uri when targeting paths

http.request.uri.path does not carry the full path — only its last segment: for a request to /admin/login its value is /login. To match prefixes/suffixes on the full path, use http.request.base_uri (without the query string) or http.request.uri (with it).

Prefixes don't respect word boundaries

has_prefix /admin matches not only /admin and /admin/login but also /administrator — it is a plain string prefix. To target only the directory, use /admin/ as the value and add a separate == condition for the bare /admin root.

Numeric comparison: gt, ge, lt, le

Greater than, greater or equal, less than and less or equal, respectively. Valid on numeric fields: the bot score (0–100), the origin response status, the AS number and the TLS version. Combine two conditions with AND to define a range.

# Block strong bot signals
IF   waf.bot_score ge 80
THEN block

# CAPTCHA for the uncertain range (50 ≤ score < 80)
IF   waf.bot_score ge 50
AND  waf.bot_score lt 80
THEN captcha

# Count all 4xx errors toward automatic blocking
IF   http.response.status ge 400
AND  http.response.status lt 500
THEN failban

With these selections in the console:

• Block strong bot signals — Field Bot Score (0–100) · Operator greater or equal · Value 80 → Action Block
• CAPTCHA for the uncertain range — Field Bot Score (0–100) · Operator greater or equal · Value 50 AND Operator less than · Value 80 → Action CAPTCHA
• Count all 4xx errors — Field Origin Response Status · Operator greater or equal · Value 400 AND Operator less than · Value 500 → Action Auto-Block

Mind the difference between ge and gt when picking thresholds: ge 80 includes a request scored exactly 80, gt 80 does not. The engine also accepts > >= < <= as synonyms for these operators.

---

Which field supports which operators?

The console never offers an invalid combination; still, knowing the mapping speeds up rule design:

Field type	Example fields	Operators
Text	http.request.base_uri, http.request.uri, http.host, http.user_agent, http.header, http.cookie, http.referer	All — equality, list, text search, prefix/suffix
Code / category	ip.country, http.request.method, http.request.version, waf.client.bot_category, waf.client.ip_type	== != in not_in
Bot name	waf.client.bot_name	== != in not_in contains
IP	ip.src, ip.prefix	== != in not_in
IP list	ip.list	Only in not_in
Numeric + list	ip.asnum, tls.version	== != in not_in gt ge lt le
Bot score	waf.bot_score	Only gt ge lt le
Response status	http.response.status	== != gt ge lt le
Response header	http.response.header	== != contains not_contains
On/off	waf.client.bot, waf.client.vpn, waf.client.tor, waf.client.proxy, waf.client.relay	== !=

The full operator list for every field lives on its own reference page — browse them from the Fields catalog.

Next steps

FieldsThe full catalog of 30 fields — IP, HTTP, bot, TLS, response

ActionsWhat happens to a matching request — block, captcha, ratelimit...

Rule EngineAND/OR logic, evaluation order and limits

Rule ExamplesReady-made patterns: bot blocking, geo restriction, API protection