Upgrading to Cloudflare’s New WAF

TLDR: Cloudflare has released a new Web Application Firewall (WAF) and is phasing out the old managed rules on May 1, 2024. Migrate to the new WAF or contact us for help.

In today’s digital age, website security is more important than ever before. That’s why Cloudflare, a leading provider of internet security and performance services, has recently launched a new and improved Web Application Firewall (WAF) that offers better protection and enhanced functionality.

However, this update means the existing managed firewall rules will deprecate on May 1, 2024. As a website owner, it’s essential to migrate to the new WAF before the old rules become obsolete. In this blog post, we’ll cover what you need to know about the WAF upgrade and how our team can help you with the migration process.

The Web Application Firewall (WAF) is a critical component of Cloudflare’s security services. It acts as a protective barrier between your website and potential threats, filtering out malicious traffic and preventing attacks like SQL injections, cross-site scripting, and more.

Cloudflare’s WAF is powered by a set of preconfigured rules called Managed Rules, designed to identify and block the most common types of attacks. Additionally, it allows you to customize rules specific to your website’s needs.

We are here to help you properly audit and configure your Cloudflare deployment to ensure you have best practice security and performance optimization in place. If you need assistance with your Cloudflare setup, do not hesitate to seek expert help. Clarkes.Team specializes in server & website management, security & performance optimization solutions.

Contact Us For A Consultation

Cloudflare’s new WAF includes a host of new and improved features, offering better detection and mitigation of known bad traffic, more flexible exception handling for Managed Rules, and full wirefilter syntax support for Rate Limiting. The upgrade provides better action customization with Custom Rules and a unified API for all these products.

Every Cloudflare customer has access to the new products at no additional cost. However, the old Managed Rules, Firewall Rules, and Rate Limiting Rules have entered a deprecation phase that will last one year. During this time period, these products are fully supported, but you are strongly advised to migrate to the newer version before May 1, 2024.

To migrate to Cloudflare’s new WAF, follow these steps:

1. Migrate WAF Managed Rules by visiting the dashboard at Security > WAF > Managed Rules and following the instructions. Note that Managed Rules are not available to Free zones.
2. Recreate your Rate Limiting rules in the new system and delete the old rules. You have access to both Rate Limiting products under Security > WAF > Rate Limiting.
3. Firewall Rules have already been migrated to Custom Rules (Security > WAF > Custom Rules) for all Free, Professional, and Business customers. No further action is required. In the next few weeks, all Enterprise customers will be automatically migrated as well.
4. If you are an API or Terraform user, you will need to update your automation to use rulesets.
5. If possible, we recommend that you recreate your Zone Lockdown and User Agent Blocking rules using Custom Rules.

At Clarkes.Team, we understand that migrating to a new WAF can be challenging and time-consuming, especially for businesses that rely on their website’s security. That’s why we’re here to help you through the entire process, from start to finish.

For our proactively managed clients, we’re already working diligently to migrate your configuration to the new WAF. We’ll keep you informed throughout the process and answer any questions you may have.

If you’re not an active client and need help, don’t hesitate to contact us for a consultation; we’d love to help!