Check ID: zone_waf_owasp_ruleset_enabled
Provider: Cloudflare
Service: zone
Severity: HIGH
Categories: vulnerabilities
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for OWASP managed rulesets by checking if they are enabled to protect against common web application vulnerabilities including SQL injection, XSS, and other OWASP Top 10 threats.

​
Risk

Without OWASP managed rulesets, web applications are exposed to well-known attack vectors.
  • Confidentiality: SQL injection attacks can exfiltrate sensitive database contents
  • Integrity: XSS attacks can modify page content and steal session tokens
  • Availability: remote code execution can compromise server availability

​
Recommendation

Enable OWASP Core Ruleset managed rules as part of a defense in depth strategy.
  • Protects against OWASP Top 10 vulnerabilities including SQLi and XSS
  • Regularly review and tune rule sensitivity based on application requirements
  • Monitor WAF analytics to identify and address false positives
  • Combine with custom rules for application-specific protection

​
Remediation

# Enable OWASP managed WAF rulesets
resource "cloudflare_ruleset" "waf_owasp" {
  zone_id = "<ZONE_ID>"
  name    = "OWASP Managed Rules"
  kind    = "zone"
  phase   = "http_request_firewall_managed"
  rules {
    action = "execute"
    action_parameters {
      id = "4814384a9e5d4991b9815dcfc25d2f1f" # Cloudflare OWASP Core Ruleset
    }
    expression  = "true"
    description = "Execute Cloudflare OWASP Core Ruleset"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_waf_owasp_ruleset_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks