Check ID: zone_firewall_blocking_rules_configured
Provider: Cloudflare
Service: zone
Severity: MEDIUM
Categories: internet-exposed
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for firewall blocking rules by checking if custom rules use block, challenge, js_challenge, or managed_challenge actions to actively protect against threats rather than only logging.

​
Risk

Firewall rules configured only for logging provide visibility but no protection.
  • Confidentiality: malicious traffic can access and exfiltrate sensitive data
  • Integrity: application exploits can modify data without being blocked
  • Availability: credential stuffing and abuse attacks reach the origin unimpeded

​
Recommendation

Configure firewall rules with blocking actions to enforce security policies.
  • Use challenge actions for suspicious traffic to verify human visitors
  • Use block actions for known malicious patterns and high-risk sources
  • Test rules in log mode before enabling blocking to avoid false positives
  • Follow the principle of least privilege in rule configuration

​
Remediation

# Configure firewall rule with blocking action
resource "cloudflare_ruleset" "blocking_rule" {
  zone_id = "<ZONE_ID>"
  name    = "Block malicious requests"
  kind    = "zone"
  phase   = "http_request_firewall_custom"
  rules {
    action      = "block" # Actively blocks matching traffic
    expression  = "(ip.geoip.country eq \"XX\")"
    description = "Block traffic from high-risk country"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_firewall_blocking_rules_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks