Account Level WAF vs Zone Level WAF Managed Rules

Cloudflare Enterprise plans now have access to an account wide WAF which can deploy the 3 core Managed Rulesets.

This is great, but the documentation is unclear about how the account wide WAF interacts with the Zone Level WAF.

If for example, I have enabled the ‘Cloudflare Managed Ruleset’ account wide, does it still make sense to have zone-level Cloudflare Managed Ruleset enabled or is this skipped once account level is enabled.

Follow Up
If both WAFs ‘fire’ what is the sequence? There is a lack of documentation about traffic sequence beyond the high level ‘product’ flow.

waf enterprise #traffic-sequence

1 Like

I got this answer via support in case helpful for others.

If both are enabled, account-level WAF take precedence over zone-level WAF. If you are managing WAF on account-level, you do not need to enable zone-level WAF.

1 Like