Custom Rules
최신 업데이트：2026-03-23 15:05:06
Configuring Custom Rules
Reading time: About 7 minutes
Prerequisites: None, as long as the hostname has been onboarded.
What Custom Rules Are For
When standard policies such as WAF Managed Rules, Bot Management, and Rate Limiting cannot meet your specific business security requirements, use Custom Rules for granular control.
Custom Rules allow you to:
- Apply special actions (Deny/Log/Reset Connection, etc.) to specific paths or sources
- Combine multiple match conditions for complex logic
- Adjust priority to override the behavior of other policies
Creating a Custom Rule
- Go to Security Settings > Policies, and click the target hostname to enter the policy details page.
- Click the Custom Rules tab in the top navigation, then click Add Rule.
- Fill in the configuration fields below, then click Save.
Basic Configuration
| Configuration Item | Description |
|---|---|
| Rule Name | Used for log identification; it is recommended to describe the rule’s purpose |
| Match Conditions | Defines the request scope for the rule (supports AND/OR combinations of multiple conditions) |
| Action | The action to take when matched (see details below) |
| Priority | Lower numbers indicate higher priority. Rules with the same priority are ordered by creation time |
Action selection guide:
| Action | Use When |
|---|---|
| Not Used | Skip traffic detection for the current rule or feature; requests continue to other detection modules |
| Log | During the rule validation phase — only records logs without affecting normal access |
| Deny | The request is confirmed as malicious — directly block access and return an error page; stop matching subsequent rules once triggered |
| Reset Connection | Directly reset the TCP connection without returning any response |
| Delay | Delay the response — used to counter high-frequency requests from automated tools |
Match Conditions
Supported field types: Request path, HTTP method, Client IP, Request header, Cookie, User-Agent, Request parameters, etc.
Configuration Examples
Example 1: Block Requests with a Specific User-Agent
Requirement: A malicious tool with the User-Agent MassScanner/3.0 has been identified and needs to be blocked immediately.
Configuration:
- Condition: User-Agent contains
MassScanner - Action: Deny
Example 2: Enforce Cookie Verification for the Admin Panel
Requirement: Only allow real browsers that have passed JavaScript Verification to access the /admin path, preventing automated tools from reaching the admin interface.
Configuration:
- Condition: Request path starts with
/admin - Action: Cookie Verification
Rule Priority
When a request matches multiple custom rules, the rules are evaluated in descending order of priority. If a rule with the Deny action is triggered, evaluation stops immediately and subsequent rules are not checked. If the request is not denied, it continues to match all remaining rules.