Get Better Visibility For The WAF With Payload Logging
Cloudflare, Monday, November 24th, 2025
As the surface area for attacks on the web increases, Cloudflare's Web Application Firewall (WAF) provides a myriad of solutions to mitigate these attacks.
This is great for our customers, but the cardinality in the workloads of the millions of requests we service means that generating false positives is inevitable. This means that the default configuration we have for our customers has to be fine-tuned.
Fine-tuning isn't an opaque process: customers have to get some data points and then decide what works for them. This post explains the technologies we offer to enable customers to see why the WAF takes certain actions - and the improvements that have been made to reduce noise and increase signal.