Cloudflare WAF

This core capability provides pre-configured, continuously updated threat signatures maintained directly by Cloudflare security analysts. It inspects incoming HTTP and HTTPS requests to block OWASP Top 10 vulnerabilities like cross-site scripting (XSS), SQL injection, and application flaws without requiring teams to write or maintain custom rulesets.

This feature monitors request frequency across endpoints to prevent brute-force login attempts like credential stuffing and web scraping. Security teams can set specific request thresholds based on IP ranges or session headers, automatically triggering managed challenges or rate caps when limits are breached. Users can also use this feature to limit cookie deployment and other tracking hooks.

Security administrators can use this feature to build and deploy security policies centrally across multiple domains and web zones. It allows teams to define rule sets at the account level and apply them globally. Administrators can use match expressions to target specific URI paths or traffic types, making consistent security posture possible and removing manual repetitive setups across large enterprise fleets.

Content prefetch is an automated resource loading feature that identifies and retrieves specific assets and data payloads before a user must request them. The platform uses this to analyze navigation patterns and active DOM elements to send fetch requests to the edge cache or origin server.