Cloudflare Docs

Cloudflare Docs

Overview
About
Actions
Order and priority
IP Lists
Manage rules in the dashboard
Create, edit, and delete rules
Edit rule expressions
Preview rules
Use IP Lists

Manage lists
Manage IP List items
Use lists in expressions

Create a mTLS rule
Manage rules via the APIs
Firewall Rules API

JSON object
Endpoints
POST example
GET examples
PUT examples
DELETE examples

Cloudflare Filters API

What is a filter?
JSON object
Endpoints
POST example
GET examples
PUT examples
DELETE examples
Expression validation

Rules Lists API

JSON object
Endpoints

Call sequence
Common use cases
Block Microsoft Exchange Autodiscover requests
Block requests based on IP reputation
Challenge bad bots
Exempt partners from Hotlink Protection
Require a specific cookie
Require a valid HMAC token
Require specific HTTP headers
Require specific HTTP ports
Site administration — Require known IP addresses
Stop R-U-Dead-Yet? (R.U.D.Y.) attacks
Update firewall rules for customers or partners
FAQ

Block requests based on IP reputation

A powerful feature of firewall rules is its support for Cloudflare’s IP reputation score. To block requests based on IP reputation, use the cf.threat_score field, which can contain a score from 0 to 100. Reputation scores are collected from Project Honeypot.

This example blocks requests from IP addresses that score greater than 0. This is equivalent to setting the Security Level in Security > Settings to High. For more, refer to Understanding the Cloudflare Security Level.

This example also blocks requests based on country code ( ISO 3166-1 Alpha 2 format):

Expression	Action
`(ip.geoip.country in {"CN" "TW" "US" "GB"}) or cf.threat_score > 0`	Block