[{"data":1,"prerenderedAt":562},["ShallowReactive",2],{"insight-cloudflare-waf-and-ddos":3,"insights-cards":452},{"id":4,"title":5,"body":6,"category":433,"date":434,"description":435,"extension":436,"meta":437,"navigation":438,"path":439,"readingTime":440,"relatedArticles":441,"relatedAssessment":445,"relatedServices":446,"seo":449,"stem":450,"__hash__":451},"insights\u002Finsights\u002Fcloudflare-waf-and-ddos.md","Managed Rules Know the Internet. Custom Rules Have to Know Your Application.",{"type":7,"value":8,"toc":421},"minimark",[9,13,18,21,24,27,30,34,37,170,173,176,180,183,186,193,203,206,209,225,229,232,235,263,266,269,272,286,290,293,296,302,305,309,312,318,324,330,336,342,346,349,381,385,388,411,414,418],[10,11,12],"p",{},"A managed ruleset is written by people who have seen a great many attacks and have never seen your application. That is exactly why it is good at stopping what is common to every site, and why it cannot make the decisions that depend on what normal looks like for you. The practical question is where the line falls, and which handful of custom rules is worth writing on your side of it.",[14,15,17],"h2",{"id":16},"what-the-managed-layer-really-does","What the managed layer really does",[10,19,20],{},"Cloudflare's WAF ships vendor-maintained rulesets. In broad terms there are two styles.",[10,22,23],{},"The first is a signature-style ruleset maintained by Cloudflare's own team. It targets known exploit patterns and specific vulnerabilities in widely used software. Its biggest practical benefit is speed: when a serious vulnerability in a popular framework or product is disclosed, a rule for it often arrives before you have finished patching. You get that protection without doing anything.",[10,25,26],{},"The second is an implementation of the OWASP Core Rule Set. It works by scoring. Each matching rule adds to a request's anomaly score, and the request is acted on when the total crosses a threshold. You control the sensitivity (how many rules participate) and the threshold (how much evidence is needed). This makes it broader and also more prone to false positives.",[10,28,29],{},"Together these cover the generic injection and traversal families well: SQL injection, cross-site scripting, command injection, path traversal, known bad payloads and scanners. For those, the right amount of custom work is close to zero. Turn the managed rules on, in the strongest action your traffic tolerates, and keep them updated automatically.",[14,31,33],{"id":32},"what-no-generic-rule-can-know","What no generic rule can know",[10,35,36],{},"The managed layer inspects requests for patterns that look malicious. Many real attacks do not look malicious at all. Each request is well formed. The abuse is in the intent, the volume or the sequence.",[38,39,40,56],"table",{},[41,42,43],"thead",{},[44,45,46,50,53],"tr",{},[47,48,49],"th",{},"Situation",[47,51,52],{},"Does the managed layer handle it?",[47,54,55],{},"What closes the gap",[57,58,59,71,82,98,109,120,139,149,159],"tbody",{},[44,60,61,65,68],{},[62,63,64],"td",{},"Classic SQL injection or XSS probe",[62,66,67],{},"Yes",[62,69,70],{},"Nothing extra",[44,72,73,76,79],{},[62,74,75],{},"Exploit for a newly disclosed framework vulnerability",[62,77,78],{},"Usually, once a rule ships",[62,80,81],{},"Patch anyway",[44,83,84,92,95],{},[62,85,86,87,91],{},"Credential stuffing against ",[88,89,90],"code",{},"\u002Flogin"," with valid-looking requests",[62,93,94],{},"Only partly",[62,96,97],{},"Rate limit keyed to your real login behavior, plus leaked-credential checks",[44,99,100,103,106],{},[62,101,102],{},"A partner integration posting XML or SQL-like text to an import endpoint",[62,104,105],{},"It may block the partner",[62,107,108],{},"A narrow exception for that path and source",[44,110,111,114,117],{},[62,112,113],{},"Scraper walking your catalog or pricing",[62,115,116],{},"No, each request is ordinary",[62,118,119],{},"Bot signals plus a rule that acts on them",[44,121,122,133,136],{},[62,123,124,125,128,129,132],{},"Enumeration of object IDs in an API (",[88,126,127],{},"\u002Finvoices\u002F1001",", ",[88,130,131],{},"\u002F1002",", ...)",[62,134,135],{},"No",[62,137,138],{},"Authorization in the application, plus rate limiting on the pattern",[44,140,141,144,146],{},[62,142,143],{},"Abuse of an expensive endpoint (search, export, PDF generation)",[62,145,135],{},[62,147,148],{},"Rate limit or challenge on that endpoint",[44,150,151,154,156],{},[62,152,153],{},"Requests to admin paths from the open internet",[62,155,135],{},[62,157,158],{},"Restrict by identity or network",[44,160,161,164,167],{},[62,162,163],{},"Traffic sent straight to your origin IP, skipping the proxy",[62,165,166],{},"No, it never sees it",[62,168,169],{},"Lock the origin to the proxy",[10,171,172],{},"The first two rows are where a managed ruleset earns its cost. Everything below depends on knowledge only you have: what your login volume is, who your partners are, which endpoints are expensive, which paths the public should never touch.",[10,174,175],{},"One row deserves emphasis. A WAF does not fix broken authorization. If your API returns another customer's invoice when the ID is changed, no edge rule reliably saves you. That one is fixed in code.",[14,177,179],{"id":178},"false-positives-are-a-cost-not-a-nuisance","False positives are a cost, not a nuisance",[10,181,182],{},"Every blocking control has two error types. It can let an attack through, or it can stop a legitimate request. Teams measure the first and ignore the second, because the second produces no alarm. A blocked customer just sees an error page and leaves.",[10,184,185],{},"For a revenue-bearing application, a blocked checkout or a failed partner integration often costs more than the low-grade probes the rule was stopping. So tuning against false positives is part of the job, not polish.",[10,187,188,189,192],{},"The discipline is to make exceptions as narrow as the problem. Picture a wholesaler whose ERP posts order batches to ",[88,190,191],{},"\u002Fapi\u002Fv1\u002Fimport",", and the payload contains free-text notes that trip an injection signature. The wrong fixes are common: disabling the managed ruleset, or lowering sensitivity for the whole zone. The right fix is an exception that skips the specific offending rules, only for that path, only for that method, and only from the partner's addresses. In Cloudflare's rule language the match would look something like this:",[194,195,200],"pre",{"className":196,"code":198,"language":199},[197],"language-text","(http.request.uri.path eq \"\u002Fapi\u002Fv1\u002Fimport\"\n and http.request.method eq \"POST\"\n and ip.src in $partner_ips)\n","text",[88,201,198],{"__ignoreMap":202},"",[10,204,205],{},"Three conditions, one path, one named list. Everything else in the zone keeps full protection. Write the reason and the ticket number in the rule description, because in a year nobody will remember why it exists.",[10,207,208],{},"A few habits keep exceptions from eroding the baseline:",[210,211,212,216,219,222],"ul",{},[213,214,215],"li",{},"Skip individual rules or tags, not whole rulesets, when the tooling allows it.",[213,217,218],{},"Prefer identifying the caller (mutual TLS, a signed header, a known address list) over trusting a path alone.",[213,220,221],{},"Re-test exceptions when the partner or the endpoint changes.",[213,223,224],{},"Count your exceptions. A growing list is a signal that the sensitivity setting is wrong for your traffic.",[14,226,228],{"id":227},"rate-limits-designed-per-endpoint-revisited-on-a-schedule","Rate limits: designed per endpoint, revisited on a schedule",[10,230,231],{},"Rate limiting is where custom work is unavoidable, because there is no universal correct number. A sensible limit for a login form is absurd for an image path and far too loose for a password reset.",[10,233,234],{},"Design each limit by answering four questions:",[236,237,238,245,251,257],"ol",{},[213,239,240,244],{},[241,242,243],"strong",{},"What is being protected?"," A specific path and method, not the zone.",[213,246,247,250],{},[241,248,249],{},"What is the counting key?"," Client IP is the default and the weakest. Offices, universities and mobile carriers put thousands of users behind one address. Where your plan allows it, count by something closer to the actor: a session cookie, an API key header, or a combination.",[213,252,253,256],{},[241,254,255],{},"What does legitimate peak use look like?"," Take the busiest real client over the last few weeks and set the limit comfortably above it.",[213,258,259,262],{},[241,260,261],{},"What happens on a hit?"," A challenge is forgiving for browsers. A block with a clear status code is right for APIs. Choose a mitigation duration that is short enough to recover from a mistake.",[10,264,265],{},"For login in particular, counting failed attempts is better than counting all attempts. Where the platform lets you count on response status, a limit of a few failed logins per minute per client barely touches real users and slows credential stuffing dramatically. Pair it with leaked-credential detection, which flags login attempts using username and password pairs known from public breaches.",[10,267,268],{},"Then there is the failure that turns a rate limit into an outage. A limit tuned during a quiet month meets a product launch, a television mention or an email campaign that worked. Traffic triples, exactly as hoped, and the edge starts refusing customers. The control is behaving as configured. The configuration is stale.",[10,270,271],{},"Protect against it procedurally:",[210,273,274,277,280,283],{},[213,275,276],{},"Review limits against real traffic every quarter and before every planned campaign.",[213,278,279],{},"Put marketing launches on the engineering calendar, with a named person watching mitigation counts during the first hour.",[213,281,282],{},"Alert on the ratio of rate-limited requests to total requests on critical paths.",[213,284,285],{},"Favor per-client limits over global ones, so growth in the number of users does not look like abuse.",[14,287,289],{"id":288},"bots-a-score-does-nothing-until-a-rule-acts-on-it","Bots: a score does nothing until a rule acts on it",[10,291,292],{},"Bot detection assigns each request a likelihood of being automated. On the tiers that expose it, the score is available as a field you can match on. The important point is that a score by itself is only a number in a log. Protection comes from a rule that reads it and takes an action.",[10,294,295],{},"That rule should be specific. A blanket \"block everything that looks automated\" breaks your own monitoring, payment provider callbacks, partner integrations and the search engine crawlers you want. A better shape is:",[194,297,300],{"className":298,"code":299,"language":199},[197],"(http.request.uri.path contains \"\u002Fcheckout\"\n and cf.bot_management.score lt 30\n and not cf.bot_management.verified_bot)\n",[88,301,299],{"__ignoreMap":202},[10,303,304],{},"with a challenge as the action, tightened to a block once you have watched who gets caught. Different paths deserve different postures: strict on checkout and account creation, relaxed on public content, explicit allowances for your own automation.",[14,306,308],{"id":307},"ddos-the-baseline-is-on-the-residual-work-is-yours","DDoS: the baseline is on, the residual work is yours",[10,310,311],{},"Cloudflare's DDoS mitigation runs automatically for proxied traffic, across network, transport and application layers, and it is not metered by attack size. You do not need to configure it to receive the baseline. That is true, and it leads teams to stop thinking too early. What remains is specific to you.",[10,313,314,317],{},[241,315,316],{},"Close the back door."," If your origin accepts connections from anywhere, an attacker who learns its address (from old DNS records, certificate logs, an email header) can skip the edge entirely. Restrict the origin firewall to the proxy's published address ranges, or better, connect the origin outbound through a tunnel so it has no public listener at all. Authenticating the edge to the origin with a client certificate adds a second lock.",[10,319,320,323],{},[241,321,322],{},"Protect the expensive requests."," Volumetric floods are the platform's problem. A low-rate attack that sends a few hundred requests per second to your slowest search endpoint is yours, because each request is valid and each one costs you a database query. Caching, rate limits and challenges on costly endpoints are the defense.",[10,325,326,329],{},[241,327,328],{},"Tune the automatic rules when they misfire."," The managed DDoS rules can be overridden: sensitivity lowered or action changed for a specific rule. This matters for traffic that legitimately looks like a flood, such as a fleet of devices that all report in at the top of the hour, or a mobile app that retries aggressively after an outage. Fixing the client is the durable solution. The override buys time.",[10,331,332,335],{},[241,333,334],{},"Know what is not proxied."," Standard proxying covers HTTP and HTTPS. Other TCP and UDP services, and protection for your own IP ranges, are separate products. A DNS record set to bypass the proxy exposes whatever it points to.",[10,337,338,341],{},[241,339,340],{},"Have an attack-day plan."," Know who can enable a heightened challenge mode, what it does to API clients (it will break non-browser traffic), and how to turn it off.",[14,343,345],{"id":344},"roll-out-like-a-deployment","Roll out like a deployment",[10,347,348],{},"A rule that blocks traffic is a production change. Treat it that way.",[236,350,351,357,363,369,375],{},[213,352,353,356],{},[241,354,355],{},"Observe first."," Deploy in a non-blocking mode where your plan supports one, or use a challenge action, and read the matches for several days covering a full business cycle.",[213,358,359,362],{},[241,360,361],{},"Know the evaluation order."," Custom rules, rate limiting rules and managed rules run in distinct phases, and a skip action in one affects what later phases see. Draw the order once and keep the drawing.",[213,364,365,368],{},[241,366,367],{},"Keep rules in version control."," Managing the configuration through the API or an infrastructure-as-code tool gives you review, history and a one-step rollback. Changes made by hand in a dashboard at midnight are how rules end up fighting each other.",[213,370,371,374],{},[241,372,373],{},"Fewer, sharper rules."," Twenty overlapping rules written by five people are harder to reason about than six with clear descriptions. Delete what no longer matches anything.",[213,376,377,380],{},[241,378,379],{},"Review on a cadence."," Monthly, look at the top rules by matches and the rules with zero matches. Both lists are informative.",[14,382,384],{"id":383},"a-starter-set-of-custom-rules","A starter set of custom rules",[10,386,387],{},"Most applications are well served by the managed baseline plus a short list:",[210,389,390,393,396,399,402,405,408],{},[213,391,392],{},"Restrict admin and internal paths to identified users or networks.",[213,394,395],{},"A rate limit on login, counting failures.",[213,397,398],{},"A rate limit on password reset and account creation.",[213,400,401],{},"A limit or challenge on each expensive endpoint.",[213,403,404],{},"Narrow exceptions for known integrations that trip managed rules.",[213,406,407],{},"A bot rule on the one or two flows that are worth abusing.",[213,409,410],{},"Origin locked to the proxy.",[10,412,413],{},"That is seven items, and each one comes from knowing your own traffic.",[14,415,417],{"id":416},"which-of-your-current-rules-would-you-defend-if-someone-asked-why-it-exists","Which of your current rules would you defend if someone asked why it exists?",[10,419,420],{},"If the honest answer is \"about half\", the ruleset needs a review against real traffic before it needs anything new. Trivo implements WAF and DDoS configuration starting from a traffic review, so every rule has a reason and an owner. Bring your ruleset and a week of logs, and you will leave knowing which entries earn their place, which ones only add noise and which can be deleted outright.",{"title":202,"searchDepth":422,"depth":422,"links":423},2,[424,425,426,427,428,429,430,431,432],{"id":16,"depth":422,"text":17},{"id":32,"depth":422,"text":33},{"id":178,"depth":422,"text":179},{"id":227,"depth":422,"text":228},{"id":288,"depth":422,"text":289},{"id":307,"depth":422,"text":308},{"id":344,"depth":422,"text":345},{"id":383,"depth":422,"text":384},{"id":416,"depth":422,"text":417},"Cloudflare","2026-10-12","Cloudflare's managed WAF and DDoS rules stop generic attacks. Logins, APIs, bots and false positives still need rules written from your own traffic.","md",{},true,"\u002Finsights\u002Fcloudflare-waf-and-ddos",9,[442,443,444],"cloudflare-zero-trust-and-integrity","cloudflare-observability","hipaa-technical-safeguards-checklist","over-engineering",[447,448],"cloudflare","custom-software",{"title":5,"description":435},"insights\u002Fcloudflare-waf-and-ddos","YuATJaQKrm3aLs-pFJR3HmA-T8yVjFRQCxWtAeV9PuQ",[453,460,465,470,472,477,485,490,495,500,506,513,518,524,530,536,542,547,552,557],{"path":454,"title":455,"description":456,"category":457,"readingTime":440,"relatedServices":458,"date":434},"\u002Finsights\u002Fbuild-vs-buy","The License Fee Is the Small Number: A Working Guide to Build or Buy","Buying software is usually right, until the product sits on top of how you make money. How to sort capabilities, price the hidden costs and decide.","Strategy",[448,459],"modernization",{"path":461,"title":462,"description":463,"category":433,"readingTime":440,"relatedServices":464,"date":434},"\u002Finsights\u002Fcloudflare-observability","The Cloudflare Signals You Need Wired Up Before Something Breaks","Cloudflare records plenty by default. Whether a person hears about a problem in time depends on choices made in a quiet week, not mid-outage.",[447,459],{"path":466,"title":467,"description":468,"category":433,"readingTime":440,"relatedServices":469,"date":434},"\u002Finsights\u002Fcloudflare-performance-tuning","After the Static Assets: Where Cloudflare Performance Is Actually Won","Default caching handles images, CSS and JavaScript. The larger gains sit in HTML, API responses, cache keys and origin trips that nobody tuned.",[447,448],{"path":439,"title":5,"description":435,"category":433,"readingTime":440,"relatedServices":471,"date":434},[447,448],{"path":473,"title":474,"description":475,"category":433,"readingTime":440,"relatedServices":476,"date":434},"\u002Finsights\u002Fcloudflare-zero-trust-and-integrity","Who Got In Versus What Is Running: Two Integrity Problems One Control Cannot Solve","Zero Trust verifies who reaches a system. Client-side script monitoring verifies what runs in the browser. They fail differently and need separate owners.",[447,459],{"path":478,"title":479,"description":480,"category":481,"readingTime":482,"relatedServices":483,"date":434},"\u002Finsights\u002Fcrm-adoption-and-training","Your CRM Passed Every Test and Nobody Uses It: A Diagnostic for Stalled Adoption","Low CRM adoption is rarely a training gap. How to tell whether the cause is screen friction, missing payback or management habits, and what to fix first.","CRM",8,[484],"crm",{"path":486,"title":487,"description":488,"category":481,"readingTime":482,"relatedServices":489,"date":434},"\u002Finsights\u002Fcrm-implementation-timeline","The Honest Calendar of a CRM Implementation: Five Phases and Where the Weeks Go","Provisioning a CRM takes a day. Making it the place your team sells from takes months. A phase-by-phase calendar, with the parts quotes tend to leave out.",[484,448],{"path":491,"title":492,"description":493,"category":481,"readingTime":440,"relatedServices":494,"date":434},"\u002Finsights\u002Fcrm-migration-checklist","CRM Migration Checklist: The Records Arrive, the Selling Process Gets Left Behind","A CRM migration is a process migration with a data load attached. What a plain export loses, how to choose a cutover, and a checklist for each stage.",[484,459],{"path":496,"title":497,"description":498,"category":481,"readingTime":482,"relatedServices":499,"date":434},"\u002Finsights\u002Fcustom-crm-vs-off-the-shelf","Should You Build Your Own CRM? Run the Build-or-Buy Test on Your Sales Process","Most of a CRM is a commodity you should buy. The question is whether the way you sell fits the platform's model, and what it costs when it does not.",[484,448],{"path":501,"title":502,"description":503,"category":457,"readingTime":504,"relatedServices":505,"date":434},"\u002Finsights\u002Fcustom-software-cost-framework","Estimate Before the Estimate: Sizing a Custom Software Budget on Your Own","You can't know the price before a quote, but you can know what drives it. Six cost drivers, a self-check worksheet and how to read a proposal.",10,[448],{"path":507,"title":508,"description":509,"category":510,"readingTime":440,"relatedServices":511,"date":434},"\u002Finsights\u002Fetl-vs-elt","Transform before or after loading? A practical ETL versus ELT decision for mid-sized teams","ETL or ELT is a question of where transformation runs and who pays for it. A practical way for a mid-sized team to choose, with the costs most plans miss.","Data",[448,512],"ai-automation",{"path":514,"title":515,"description":516,"category":457,"readingTime":504,"relatedServices":517,"date":434},"\u002Finsights\u002Fevaluating-engineering-depth","Ask About the Outage: How to Vet a Software Vendor's Real Engineering Ability","Portfolios and logos look the same from every vendor. The interview questions, artifacts and deal-breakers that show who has really run software in production.",[448,459],{"path":519,"title":520,"description":521,"category":522,"readingTime":504,"relatedServices":523,"date":434},"\u002Finsights\u002Fhipaa-business-associate-agreement","A BAA Is a Contract, Not a Badge: What Your Software Vendor Is Really Signing Up For","What a HIPAA Business Associate Agreement commits a software vendor to, what it leaves unproven, and what to ask and build before PHI reaches the system.","Compliance",[448,512],{"path":525,"title":526,"description":527,"category":522,"readingTime":528,"relatedServices":529,"date":434},"\u002Finsights\u002Fhipaa-technical-safeguards-checklist","Reading 45 CFR 164.312 Like a Design Document: HIPAA Technical Safeguards for Engineers","The five HIPAA technical safeguard standards mapped to concrete engineering decisions: identity, logging, integrity, authentication and encryption.",11,[448,459,447],{"path":531,"title":532,"description":533,"category":534,"readingTime":440,"relatedServices":535,"date":434},"\u002Finsights\u002Flegacy-erp-anticorruption-layer","The ERP stays as it is: building on a decades-old system through an anti-corruption layer","How to build new software on an old ERP without modifying it, using an anti-corruption layer: what goes inside, how to handle writes, when to skip it.","Modernization",[459,448],{"path":537,"title":538,"description":539,"category":540,"readingTime":504,"relatedServices":541,"date":434},"\u002Finsights\u002Fllm-in-production-confidence-thresholds","An LLM that proposes and a system that decides: thresholds, review and audit for production AI","Running an LLM in production without giving it autonomy: measured confidence, thresholds set by business cost, human review that works, an audit trail.","AI",[512,448],{"path":543,"title":544,"description":545,"category":457,"readingTime":440,"relatedServices":546,"date":434},"\u002Finsights\u002Fnearshore-offshore-onshore-cost","Cheap Hours, Expensive Projects: Pricing US, Nearshore and Offshore Teams Honestly","The hourly rate tells you little about what a project will cost. How overlap, rework, turnover and compliance change the math for each delivery model.",[448],{"path":548,"title":549,"description":550,"category":540,"readingTime":440,"relatedServices":551,"date":434},"\u002Finsights\u002Frpa-vs-api-integration","Bots on the screen or calls to the API: where RPA earns its place and where it becomes debt","RPA and API integration solve the same problem at different layers. How to choose, what screen automation really costs, and how to run it safely if you must.",[512,448],{"path":553,"title":554,"description":555,"category":534,"readingTime":440,"relatedServices":556,"date":434},"\u002Finsights\u002Fstrangler-fig-modernization","Replace the legacy system in slices: a working guide to the strangler fig pattern","How to retire a legacy system piece by piece while the business keeps running: the facade, the first slice, parallel runs, and when the pattern fails.",[459,448],{"path":558,"title":559,"description":560,"category":457,"readingTime":504,"relatedServices":561,"date":434},"\u002Finsights\u002Ftwo-week-discovery-deliverables","Paying for a Plan, Not a Pitch: What Two Weeks of Discovery Owes You","A paid discovery should leave you with documents another team could build from. The five deliverables, the work behind them and the limits to expect.",[448,459],1792618973202]