One WAF configuration for every domain on your account
Cloudflare’s security products have traditionally been scoped to a single zone — roughly one domain. That works fine when you manage a handful of domains, but organizations with hundreds or thousands of domains face a repetitive, error-prone workflow: every rule or managed ruleset deployment must be duplicated on each zone, and updates require visiting each zone’s dashboard individually.
APIs and Terraform can automate the process, but not every team has the capacity to build and maintain that tooling, and a scripted deployment doesn’t offer the same confidence as configuring security through a well-designed UI. Account WAF addresses this by letting Enterprise customers define one WAF configuration that applies across all domains on the account.
Deploy rulesets once, scope them by filter
Managing many domains is more common than it might seem. An e-commerce business, for instance, may run separate marketing domains for each brand and country, plus domains for APIs, partner integrations, logistics, payment systems, and internal employee tools. In these complex accounts, applying Cloudflare’s Managed ruleset across all production domains previously meant tracking down each domain and configuring the ruleset individually, including any overrides to select specific attack vectors.
With Account WAF, you deploy a managed ruleset a single time, then write a filter that determines which requests the ruleset runs on. The filter uses the standard WAF Custom Rule expression language — the Wirefilter syntax — so it can match on any HTTP request parameter, metadata, or computed value such as Bot Score or WAF Attack Score. For example, a ruleset can be scoped to a particular User Agent or to API traffic only.
Multiple deployments are supported, so different rulesets can target different groups of domains. You could apply OWASP with a higher sensitivity level to production domains and a lower one to staging, or enforce a baseline level of security across all zones for compliance before layering on stricter rules for sensitive domains. Adding a new domain later is simply a matter of updating the filter on an existing deployment; the new domain is protected immediately.
Custom and rate limiting rules follow the same model
Account-level WAF Custom Rules and Rate Limiting rules are managed through the concept of Custom Rulesets. Whereas managed rulesets are prebuilt, Custom Rulesets group user-defined rules. The deployment flow is identical: create a Custom Ruleset containing your rules, then attach it to a filter that scopes which traffic the rules apply to.
As an example, you could create a Custom Ruleset with two rules — one blocking traffic from a set of countries, and another allowing only requests with a non-malicious WAF Attack Score. Deploy that ruleset once across the entire account, and all matching domains are covered.
Two constraints apply:
- Account WAF rulesets (Managed, Custom, and Rate Limiting) can only run on traffic to domains on Enterprise plans. The UI enforces this when you write a deployment filter, so rulesets cannot accidentally target Free, Pro, or Biz domains.
- A Custom Ruleset must contain either Custom rules or Rate Limiting rules — they cannot be mixed in the same ruleset at this stage. Rate Limiting support in Account WAF is scheduled for October.
Availability
Account WAF is an Enterprise-only feature. Enterprise customers on the Advanced plan will see it enabled automatically this week. Other Enterprise customers should contact their account team for details on getting access.
