> For the complete documentation index, see [llms.txt](https://corey-bui.gitbook.io/cloudflare-guides/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://corey-bui.gitbook.io/cloudflare-guides/waf-web-application-firewall.md).

# WAF (Web Application Firewall)

## Overview

Provides both automatic protection from vulnerabilities and the flexibility to create custom rules.

### Main features <a href="#main-features" id="main-features"></a>

* **Custom rules**: Create your own custom rules to protect your website and your APIs from malicious incoming traffic.
* **Rate limiting rules**: Set rate limits for incoming requests matching an expression, and the action to take when those rate limits are reached.
* **WAF Managed Rulesets**: Enable the pre-configured Managed Rulesets to get immediate protection. Adjust the behavior of managed rules, choosing from several possible actions.
* **Exposed Credential Checks**: Monitor and block the use of stolen/exposed credentials for account takeover.
* **Firewall Analytics**: Identify and investigate security threats using an intuitive interface. Tailor your security configurations based on the activity log.

## WAF Request Match

This section sets fields for what the WAF will apply to.&#x20;

* Field: Variable&#x20;

> ## Step 1: Find WAF in Cloudflare
>
> You can find WAF on the left hand side under security.&#x20;

![](/files/xLZHk7ZKlEJd4lD2MU8z)

## Step 2: Create Your First Firewall Rule&#x20;

![](/files/9pCSxXT2tCHwQzkmwgAM)

## Step 3: Choose a Guide

### Blocking Guides:&#x20;

Follow our handy guides to get started on the basics as quickly as possible:

{% content-ref url="/pages/5ok0VQvIE6K7mTfx2rra" %}
[Block a Country](/cloudflare-guides/waf-web-application-firewall/guides/block-guide/block-a-country.md)
{% endcontent-ref %}

{% content-ref url="/pages/czYPBdeZDl76WvW7l8vc" %}
[Block a Continent](/cloudflare-guides/waf-web-application-firewall/guides/block-guide/block-a-continent.md)
{% endcontent-ref %}

{% content-ref url="/pages/l77z14eE25kvWZ3pG20W" %}
[Block by IP Address](/cloudflare-guides/waf-web-application-firewall/guides/block-guide/block-by-ip-address.md)
{% endcontent-ref %}

{% content-ref url="/pages/5ok0VQvIE6K7mTfx2rra" %}
[Block a Country](/cloudflare-guides/waf-web-application-firewall/guides/block-guide/block-a-country.md)
{% endcontent-ref %}

### CAPTCHA Guides:

Learn the fundamentals Captcha:

{% content-ref url="/pages/lEq52HBuAj0Tw52e37Y0" %}
[Legacy CAPTCHA by Browser](/cloudflare-guides/waf-web-application-firewall/guides/legacy-captcha-guide/legacy-captcha-by-browser.md)
{% endcontent-ref %}

{% content-ref url="/pages/dDnECk8geJqdTQV2UFxl" %}
[Legacy CAPTCHA for Country](/cloudflare-guides/waf-web-application-firewall/guides/legacy-captcha-guide/legacy-captcha-for-country.md)
{% endcontent-ref %}

{% content-ref url="/pages/07ZgHrWdYRLGdn8RC1Mm" %}
[Legacy CAPTCHA IP Address](/cloudflare-guides/waf-web-application-firewall/guides/legacy-captcha-guide/legacy-captcha-ip-address.md)
{% endcontent-ref %}

{% content-ref url="/pages/3wPFBsX4FqVcXkWeX0Cg" %}
[Legacy CAPTCHA Continent](/cloudflare-guides/waf-web-application-firewall/guides/legacy-captcha-guide/legacy-captcha-continent.md)
{% endcontent-ref %}