Www subdomain is not being blocked by WAF nor Worker

[daniel.bonilla]

Answer these questions to help the Community help you with Security questions.

What is the domain name?
I’m trying to limit access to my root domain and all its subdomains but neither WAF rules nor Worker is triggered for the www subdomain. Any other subdomain I created is working fine but not for www. I’m sure the DNS records are being proxied.

Have you searched for an answer?

I reviewed configuration guidelines and haven’t found if “www” is a special subdomain.

*When you tested your domain using the [Cloudflare Diagnostic Center]
It cannot be completed

Describe the issue you are having:
Need to be able to block my domain and any subdomain with my Worker and only allow the traffic to whitelist IP,

What error message or number are you receiving?
The request is completed from any source IP

What steps have you taken to resolve the issue?

1. Delete DNS record and re-create it. Make traffic is proxied in Cloudflare
2. Enable and disable WAF rules
3. Create a Worker with one single whitelist IP address to test.

Was the site working with SSL prior to adding it to Cloudflare?
yes

What are the steps to reproduce the error:

1. You just need to try to connect to www

Have you tried from another browser and/or incognito mode?
Yes, tried incognito and clearing the cache

Please attach a screenshot of the error:

[Cyb3r-Jak3]

Can you share your firewall rule? Also can you share your full domain.

[daniel.bonilla]

lowesmro_com

when you go to www_lowesmro_com, the website is loaded instead of being blocked

WAF:
I have two lists of IP addresses for whitelist
if
(not ip.src in $lps_public_ips) or (not ip.src in $lowes_public_ips)
then Block

[Cyb3r-Jak3]

How about trying something like this

((not ip.src in $example_list_1) or (not ip.src in $example_list_2)) and http.host eq "www.example.com"

Just an FYI when I open lowesmro.com I am getting redirected to the www version.