Back to Checks
cloudflare

Cloudflare Zone Firewall Rules Use Blocking Actions to Protect Against Threats

zone_firewall_blocking_rules_configured
Service: zoneSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Zone

Cloudflare zones are assessed for firewall blocking rules by checking if custom rules use block, challenge, js_challenge, or managed_challenge actions to actively protect against threats rather than only logging.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Firewall rules configured only for logging provide visibility but no protection.

  • Confidentiality: malicious traffic can access and exfiltrate sensitive data
  • Integrity: application exploits can modify data without being blocked
  • Availability: credential stuffing and abuse attacks reach the origin unimpeded

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_firewall_blocking_rules_configured

Recommendation

Configure firewall rules with blocking actions to enforce security policies.

  • Use challenge actions for suspicious traffic to verify human visitors
  • Use block actions for known malicious patterns and high-risk sources
  • Test rules in log mode before enabling blocking to avoid false positives
  • Follow the principle of least privilege in rule configuration

Remediation

Terraform

# Configure firewall rule with blocking action
resource "cloudflare_ruleset" "blocking_rule" {
  zone_id = "<ZONE_ID>"
  name    = "Block malicious requests"
  kind    = "zone"
  phase   = "http_request_firewall_custom"
  rules {
    action      = "block" # Actively blocks matching traffic
    expression  = "(ip.geoip.country eq \"XX\")"
    description = "Block traffic from high-risk country"
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Security > WAF > Custom rules
3Review existing rules and their actions
4Update rules to use blocking actions (Block, Challenge, JS Challenge, Managed Challenge)
5Test rules in log mode first, then enable blocking actions

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client

BLOCKING_ACTIONS = {"block", "challenge", "js_challenge", "managed_challenge"}


class zone_firewall_blocking_rules_configured(Check):
    """Ensure that firewall rules with blocking actions are configured for Cloudflare zones.

    Firewall rules should use blocking actions (block, challenge, js_challenge,
    managed_challenge) to actively protect against threats rather than only logging
    traffic. Without blocking actions, malicious requests can reach the origin server
    and potentially compromise the application's security.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the firewall blocking rules configured check.

        Iterates through all Cloudflare zones and verifies that at least one
        firewall rule exists with a blocking action. Blocking actions include
        block, challenge, js_challenge, and managed_challenge.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if blocking
            rules are configured, or FAIL status if no blocking rules exist.
        """
        findings = []

        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )

            # Find blocking rules for this zone
            blocking_rules = [
                rule for rule in zone.firewall_rules if rule.action in BLOCKING_ACTIONS
            ]

            if blocking_rules:
                report.status = "PASS"
                report.status_extended = (
                    f"Zone {zone.name} has firewall rules with blocking actions "
                    f"({len(blocking_rules)} rule(s))."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Zone {zone.name} has no firewall rules with blocking actions."
                )
            findings.append(report)

        return findings

References