Cloudflare puts a managed WAF on every plan
Cloudflare is extending its core security services to all customers, including those on the free tier. The company announced today that its Cloudflare Managed Ruleset for the Web Application Firewall (WAF) is now available at no cost to every Cloudflare plan. The move follows a pattern established with Universal SSL in 2014 and unmetered DDoS mitigation in 2017: build technology that scales efficiently, then make it available broadly.
For free-plan users, the protection is already live. Over the coming months, Cloudflare will roll out dashboard access to the WAF user interface for all free zones, allowing users to deploy and configure the new ruleset. While the free Managed Ruleset covers high-profile vulnerabilities, access to the broader set of WAF rulesets—including the Cloudflare Managed Rules, OWASP Core Ruleset, and Leaked Credential Check Ruleset—along with advanced WAF features, will still require a Pro plan or higher.
Why universal WAF coverage matters
The decision is driven by the outsized impact of high-severity vulnerabilities. Recent events like Log4J, and earlier incidents such as Shellshock and Heartbleed, have demonstrated that small application owners and teams often lack the time to keep pace with security patches. That gap leaves applications compromised and, in some cases, co-opted for malicious purposes.
With millions of Internet properties already behind its proxy, Cloudflare sees itself as having a responsibility to help secure the web at large. During the Log4J outbreak, the company deployed mitigation rules for all traffic, including free zones. The new free Managed Ruleset formalizes that commitment, built on top of Cloudflare's new WAF engine.
Performance at scale
The technical challenge is significant. Cloudflare's global network handles over 32 million HTTP requests per second, and the WAF must inspect every one of them. WAFs evaluate all HTTP request components—including bodies—by running a set of rules, or signatures, that identify patterns associated with malicious payloads. Rules vary in complexity, and as the rule set grows, optimization becomes harder. Many rules rely on regex for complex matching logic.
All of this must happen with negligible latency impact. Security shouldn't carry a performance penalty, particularly since many application owners come to Cloudflare specifically for performance benefits. Cloudflare says that by leveraging its Edge Rules Engine—the foundation of the new WAF—it has reached the performance and memory milestones necessary to offer a baseline level of protection to every user.
What the free ruleset covers
The Cloudflare Free Managed Ruleset is automatically deployed on any new zone and is designed to minimize false positives across a broad range of traffic. Users can disable the ruleset entirely, or configure the traffic filter and individual rules. The ruleset currently includes:
- Log4J rules matching payloads in the URI and HTTP headers
- Shellshock rules
- Rules matching common WordPress exploits
Whenever a rule matches, an event is generated in the Security Overview tab, allowing users to inspect the request.
Configuration and management
For all new free zones, the ruleset is deployed automatically. The rules are already battle-tested across the Cloudflare network and are safe to run on most applications out of the box. Customers who want to adjust behavior can override all rules or individual rules to log-only mode or other actions, and can completely disable the ruleset or any specific rule.
These options are accessible via the dashboard under Security > WAF > Managed Rules, and can also be exercised through the API. Documentation for configuring the ruleset will be available on Cloudflare's developer site.
Ongoing updates
The Cloudflare Free Managed Ruleset will be updated whenever a relevant, wide-ranging vulnerability is discovered. Updates will be published on the Cloudflare WAF change log so customers can stay informed about new rules.
With the free Managed Ruleset now part of every plan, Cloudflare is extending baseline WAF protection to a much larger portion of the web—no upgrade required.
