Can we use API to create WAF custom rule in free version?

Website, Application, Performance
1

What is the name of the domain?

devscript.cloud

What is the issue you’re encountering

I want to create a WordPress plugin to manage WAF custom rules for a specific zone ID. Can we use the Cloudflare API endpoint https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets to create custom rules in the free version of Cloudflare?

2

I’ve not tried it via the API, but I don’t see any mention of plan restrictions in the docs, Create a custom rule via API · Cloudflare Web Application Firewall (WAF) docs

3

In the free version, we cannot create custom rulesets. How can we create a custom WAF rule using the ruleset ID for the zone ID?

4

For Workers & Pages, what is the name of the domain?

devscript.cloud

What is the issue or error you’re encountering

I want to create a WordPress plugin to manage WAF custom rules for a specific zone ID. Can we use the Cloudflare API endpoint https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets to create custom rules in the free version of Cloudflare? In the free version, we cannot create custom rulesets. How can we create a custom WAF rule for the zone ID?

Screenshot of the error

Screenshot from 2024-12-20 10-27-21.png
Screenshot from 2024-12-20 10-27-21.png794×519 43.3 KB

5

Account-level WAF requires Enterprise.

The Custom Rulesets (e.g. collections of rules) requires Enterprise.

You can create “Custom rules” on each individual zone, which CAN be done with the Free plan.

If you’re having a rule, such as e.g. blocking all traffic that appears to originate from outside the European continent, then you will have to apply that rule individually, - once for “example.com”, and once for “example.eu”, if you want the rule to apply to both domains.

The confusion above seems to caused by mixing together individual “Custom rules” (Free) and account-level “Custom rulesets” (Enterprise).

2 Likes
6

Can we create “ Custom rules ” (Free) using the new API instead of the deprecated one?

7

When you list all the rulesets using API, you will get one with a ruleset ID for WAF custom rules. You can create up to 5 custom rules for a zone ID in Cloudflare’s free version using this ruleset ID. For example:

{
“description”: “”,
“id”: “fff7f8f0d9f8s0dfgsdf808fsd09”,
“kind”: “zone”,
“last_updated”: “2024-12-20T07:57:21.388532Z”,
“name”: “default”,
“phase”: “http_request_firewall_custom”,
“source”: “firewall_custom”,
“version”: “20”
}
Create a custom rule:
https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules \

1 Like
8

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.