How to apply different waf rules for different webservices under the same domain

[stefan.juon]

Hi folks
I am a little confused at the moment about how to configure different waf rules for different webservices under the same domain. Let’s say:

My domain is domain.org
Webservice A ist a.domain.org
Webservice B is b.domain.org

The WAF custom rules are configured on the domain level domain.org, so how can I configure different WAF custom rules for the two webservices a.domain.org and b.domain.org? Do I have to provide the “referer” in the ruleset?

If there is some a howto or another post which I did not notice yet you are welcome to point me to that.

Thanks, Stefan

[cbrandt]

@stefan.juon

The WAF custom rules are configured on the domain level

You can use the hostname field to make a rule apply only to a subdomain:

[stefan.juon]

Yes, triggering on the hostname works perfectly fine - as well as triggering on the referer. I understood, that I have one ruleset for all services to be protected over the domain in Cloudflare.