Match Conditions Reference

Reading time: About 12 minutes

This page is a complete reference for the Match Conditions field used across all security policies.

General Information

Match conditions are used to precisely define the scope of a rule. Multiple conditions can be combined using the following logic:

• AND (All conditions must be met): The request must satisfy all conditions simultaneously.
• OR (Any condition met): The rule takes effect when the request satisfies any one of the conditions.

Available Field Types

Path

The path starts with / and does not include the domain or parameters. For example, the path of www.test.com/common/ecs/channel?code=1&type=2 is /common/ecs/channel.

Case sensitivity and multiple values: Equals and Not Equals are case-sensitive; all other operators are case-insensitive. This field accepts multiple values, except Regex Match and Regex Not Match, which accept only a single value.

Performance tip: Regex matching consumes more computing resources than prefix or contains matching. Use prefix matching unless regex is necessary.

HTTP Method

Supported methods: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS

Supported operators: Equals, Not Equals. Multiple values supported: Yes.

Client IP

Supports IPv4 and IPv6. Supported operators: Equals, Not Equals. Multiple values supported: Yes.

Note: If the request is forwarded through a proxy or load balancer, the system uses the first IP in the X-Forwarded-For header as the client IP. Make sure your origin server is properly configured to pass this header.

HTTP Header

Header names are case-insensitive.

Case sensitivity and multiple values: Equals and Not Equals are case-sensitive; all other operators are case-insensitive. This field accepts multiple values, except Regex Match and Regex Not Match, which accept only a single value.

User-Agent

Behaves the same as the HTTP Header field, but is a shortcut specifically for the User-Agent header. It supports the same set of operators.

Case sensitivity and multiple values: Equals and Not Equals are case-sensitive; all other operators are case-insensitive. This field accepts multiple values, except Regex Match and Regex Not Match, which accept only a single value.

Cookie

Referer

Behaves the same as the HTTP Header field, but is a shortcut for the Referer header. It supports the same set of operators.

Case sensitivity and multiple values: Equals and Not Equals are case-sensitive; all other operators are case-insensitive. This field accepts multiple values, except Regex Match and Regex Not Match, which accept only a single value.

Query String

Matches the query string carried in the request URL as a whole, for example code=1&type=2.

Case sensitivity and multiple values: Every operator on this field is case-sensitive, so the values you enter must match the casing your business actually sends. This field accepts multiple values, except Regex Match and Regex Not Match, which accept only a single value.

Use when: A WAF rule generates false positives for legitimate requests with specific query parameters. Use query string conditions to precisely define the exception scope.

URI

The difference between URI and Path: URI includes query parameters, while the path does not.

Supported operators: Equals, Not Equals, Contains, Does Not Contain, Starts with, Ends with, Wildcard Match, Wildcard Not Match, Regex Match, Regex Not Match

Case sensitivity and multiple values: Equals and Not Equals are case-sensitive; Contains, Starts with, Ends with, Wildcard, and Regex operators are case-insensitive. This field accepts multiple values, except Regex Match and Regex Not Match, which accept only a single value.

Geo Location

Determines the request source region based on the IP geolocation database, down to the country or province level (the exact options available depend on the console). Used for IP/Geo firewall policies.

Supported operators: Equals, Not Equals. Multiple values supported: Yes.

Status Code

Matches or excludes specific HTTP response status codes. Only response-phase status codes are evaluated.

Supported operators: Equals, Not Equals. Multiple values supported: Yes.

Use when: In rate limiting, you can set limits based on specific error response codes (e.g., 404, 5xx). In custom rules, you can trigger actions based on the response status code.

Client Group

Matches or excludes requests belonging to specific client groups. Client groups are automatically classified by the platform based on request characteristics.

Supported operators: Equals, Not Equals. Multiple values supported: Yes.

ASN (Autonomous System Number)

Matches requests based on the Autonomous System Number of the source IP. Useful for bulk actions targeting IP segments of specific ISPs, cloud providers, or data centers.

Supported operators: Equals, Not Equals. Multiple values supported: Yes.

Typical use cases: Blocking IP segments from specific cloud service providers (e.g., AWS, Alibaba Cloud, etc.), or allowing traffic from a specific enterprise leased line ASN.

Special Fields (Advanced Usage)