WAF Custom Lists now cover hostnames and ASNs

Anyone who builds Web Application Firewall rules knows the pain of typing out long lists of field values directly into the rule expression editor. It is slow, error-prone, and quickly hits the 4 KB expression limit. Cloudflare's answer to this was IP lists — reusable, independently managed sets of values that rules can reference. The natural next step was to apply that same model to other matchable fields.

That step is now here. Cloudflare is expanding Custom Lists to support hostnames and Autonomous System Numbers (ASNs). All three list types — IP, hostname, and ASN — can now be created and managed in the same place and referenced across rules built on the Ruleset Engine. The new hostname and ASN lists are available to all Enterprise accounts.

Hostname lists

Hostname lists let you group domains and subdomains and reference them in WAF rule expressions. They are managed under Configurations > Lists, alongside IP lists and Managed IP Lists.

For Account WAF users, hostname lists are useful for restricting a managed or custom ruleset to traffic matching a particular set of hosts. SSL for SaaS users can use them to limit specific rules to a subset of customer hosts, updating the list programmatically via the API as hosts are onboarded.

There are a few behaviors worth knowing:

  • A domain in a list does not automatically match its subdomains. Adding example.com will not match api.example.com.
  • The * wildcard matches subdomains: *.example.com matches api.example.com but not example.com itself.
  • Paths are not accepted — example.com/path/subfolder is not a valid list entry.

ASN lists

An autonomous system is a network or group of networks with a unified routing policy, typically operated by one large organization like an ISP, a large enterprise, or a government agency. ASNs are stable identifiers, unlike IP addresses, which rotate and change frequently.

ASN lists are a practical way to manage traffic from ISPs or cloud providers that host automated bot traffic. They should be used with care: blocking an ASN blocks every IP within it, so an incorrect entry can have a wide blast radius.

Quotas and availability

Every Enterprise account can create up to 10 Custom Lists with a total of 10,000 items across all lists. Quotas are shared across IP, ASN, and hostname list types, and are applied at the account level. For example, one Enterprise account might use 8 IP lists with 1,000 items each, one hostname list with 1,700 entries, and one list with 300 ASNs — at that point no further lists or items can be added.

Enterprise customers can request higher quotas from their account team. Free, Professional, and Business plans currently have access only to IP Lists. Hostname and ASN lists work in any WAF product built on the Ruleset Engine, including custom rules, rate limiting rules, and managed rules.

What comes next: string lists

The longer-term plan is a generic string list type. It will match against fields such as headers, cookies, paths, query strings, JSON body fields, user agents, JA3 fingerprints, and MIME types. Each list entry will support a choice of matching operators — exact match, starts with, ends with, or contains.

That opens up use cases like maintaining a blocklist of user agents, restricting access to a set of URLs, applying different rate limits to users identified by cookie or API key, or collecting JA3 fingerprints of known malicious bots. String lists are still in development and are expected in the coming months.