Basic Concepts

Reading time: About 12 minutes

This page is a complete reference for the Match Conditions field used across all security policies.

General Information

Match conditions are used to precisely define the scope of a rule. Multiple conditions can be combined using the following logic:

• AND (All conditions must be met): The request must satisfy all conditions simultaneously.
• OR (Any condition met): The rule takes effect when the request satisfies any one of the conditions.

Available Field Types

Request Path (URI Path)

Performance tip: Regex matching consumes more computing resources than prefix or contains matching. Use prefix matching unless regex is necessary.

HTTP Method

Supported methods: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS

Client IP

Note: If the request is forwarded through a proxy or load balancer, the system uses the first IP in the X-Forwarded-For header as the client IP. Make sure your origin server is properly configured to pass this header.

HTTP Header

User-Agent

Behaves the same as the HTTP Header field, but is a shortcut specifically for the User-Agent header.

Cookie

Referer

Behaves the same as the HTTP Header field, but is a shortcut for the Referer header. Supports operators such as Equals, Contains, and Is Empty.

Query String

Matches parameters in the URL query string:

• Parameter name equals: keyword
• Parameter value contains: SELECT

Use when: A WAF rule generates false positives for legitimate requests with specific query parameters. Use query string conditions to precisely define the exception scope.

URI

The difference between URI and the Request Path: URI includes query parameters, while the path does not.

Supported operators: Equals, Not Equals, Contains, Does Not Contain, Starts with, Ends with, Wildcard Match, Wildcard Not Match, Regex Match, Regex Not Match

Case sensitivity: The Equals and Not Equals operators are case-sensitive; Contains, Starts with, Ends with, Wildcard, and Regex operators are case-insensitive.

Geo Location

Determines the request source region based on the IP geolocation database. Used for IP/Geo firewall policies.

Supported operators: Equals, Not Equals

Status Code

Matches or excludes specific HTTP response status codes. Only response-phase status codes are evaluated.

Supported operators: Equals, Not Equals

Use when: In rate limiting, you can set limits based on specific error response codes (e.g., 404, 5xx). In custom rules, you can trigger actions based on the response status code.

Client Group

Matches or excludes requests belonging to specific client groups. Client groups are automatically classified by the platform based on request characteristics.

Supported operators: Equals, Not Equals

ASN (Autonomous System Number)

Matches requests based on the Autonomous System Number of the source IP. Useful for bulk actions targeting IP segments of specific ISPs, cloud providers, or data centers.

Supported operators: Equals, Not Equals

Typical use cases: Blocking IP segments from specific cloud service providers (e.g., AWS, Alibaba Cloud, etc.), or allowing traffic from a specific enterprise leased line ASN.

Special Fields (Advanced Usage)