Infra Notes

Cloudflare WAF allowlist should be scoped to hostname, not everything

A WAF allowlist is safer when scoped to specific hostnames instead of the entire zone.

CloudflareCloudflareWAFAccess ControlDNSCloud Security

Problem

A Cloudflare allowlist rule is too broad.

Why it happens

IP-based allow rules are sometimes applied globally to the whole zone, which can unintentionally affect unrelated applications.

Fix / Approach

Scope WAF rules by hostname and source IP so only specific apps are affected.

Command / Config

Rule logic:

text

if hostname equals "dashboard.example.com"
and source IP is in allowed list
then allow

When to use

  • Admin dashboards
  • Internal tools
  • Restricted apps
  • Selected public hostnames

When not to use

  • Public apps that should be accessible by everyone