---
name: "cloudflare-waf-custom-rulesets"
description: "Protect web applications against DDoS, bots, and brute force using Cloudflare WAF Rulesets."
metadata:
  author: "Cloudflare"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "write cloudflare waf rule"
  - "configure cloudflare rate limiting"
  - "block bad bots cloudflare"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Cloudflare WAF Custom Rulesets & Rate Limiting

Configures Cloudflare WAF: writing custom firewall expressions using Wirefilter syntax (http.request.uri.path contains '/admin'), IP reputation checks, rate-limiting rules (requests per minute), and challenge actions.

## When to Invoke
Invoke this skill whenever you need to:
- write cloudflare waf rule
- configure cloudflare rate limiting
- block bad bots cloudflare

## Execution SOP & Rules
1. Create ruleset: kind: zone, phase: http_request_firewall_custom.
2. Define expression: (http.request.uri.path eq '/login' and ip.threat_score gt 20).
3. Set action: managed_challenge or block depending on risk severity.
4. Monitor rule matches and false positives in Cloudflare Security -> Analytics dashboard.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.