Check ID: zone_waf_enabled
Provider: Cloudflare
Service: zone
Severity: HIGH
Categories: vulnerabilities
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Web Application Firewall (WAF) configuration by checking if it is enabled to protect against common web vulnerabilities including SQL injection, XSS, and OWASP Top 10 threats.

​
Risk

Without WAF, web applications are exposed to common attack vectors.
  • Confidentiality: SQL injection attacks can exfiltrate sensitive database contents
  • Integrity: XSS attacks can modify page content and steal session tokens
  • Availability: application-layer attacks can cause service disruption

​
Recommendation

Enable WAF as a critical layer of defense for web applications.
  • Deploy managed rulesets for protection against OWASP Top 10 vulnerabilities
  • Create custom rules based on your application’s specific threat model
  • Monitor WAF analytics to tune rules and reduce false positives
  • Combine with rate limiting and bot protection for comprehensive security

​
Remediation

# Enable WAF managed rulesets for comprehensive protection
resource "cloudflare_ruleset" "waf_managed" {
  zone_id = "<ZONE_ID>"
  name    = "WAF Managed Rules"
  kind    = "zone"
  phase   = "http_request_firewall_managed"
  rules {
    action = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee" # Cloudflare Managed Ruleset
    }
    expression  = "true"
    description = "Execute Cloudflare Managed Ruleset"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_waf_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks