Cloudflare WAF allowlist: scope exceptions by hostname and path

Problem

A Cloudflare allowlist rule is too broad.

Why it happens

IP-based allow rules are sometimes applied globally to the whole zone, which can unintentionally affect unrelated applications.

Recommended approach

Constrain exceptions by hostname, source identity or IP, path when appropriate, and an explicit business purpose. Add an owner and expiry date so temporary access does not become permanent policy.

Example rule logic

Rule logic:

if hostname equals "dashboard.example.com"
and source IP is in allowed list
then allow

Prefer skipping only the specific managed rule or control that blocks the request over bypassing the entire WAF evaluation path.

Use this when

• Admin dashboards
• Internal tools
• Restricted apps
• Selected public hostnames

Avoid this when

• Public apps that should be accessible by everyone

Use a narrow skip expression

Cloudflare WAF custom rules use a Skip action for selective exceptions. An example expression is:

(http.host eq "dashboard.example.com"
 and ip.src in $trusted_admin_ips
 and starts_with(http.request.uri.path, "/admin/"))

Skip only the managed rule, ruleset, or phase that produced the false positive. Do not skip all remaining security features when one managed-rule ID is the actual problem.

Prefer managed IP lists

Store approved addresses in a named Cloudflare IP list instead of embedding a long list into every expression. This separates membership changes from rule logic and makes reviews easier.

Before relying on source IP, confirm the client uses stable, controlled egress. Shared VPN exits, NAT gateways, and third-party services can allow more users than the rule name suggests.

Validate the exception

Test four cases:

1. Approved IP, hostname, and path: request succeeds
2. Unapproved IP on the protected path: request remains blocked or challenged
3. Approved IP on another hostname: no exception
4. Approved IP on an unrelated path: normal WAF evaluation continues

Then inspect Security Events to confirm which rule matched and which controls were skipped.

Governance fields

Record these beside the rule or in its description:

• Business purpose and incident/ticket reference
• Application and hostname
• Source owner
• Specific rule or phase skipped
• Approver
• Expiry or review date

Review IP Access rules as well. An IP Access Allow can bypass later WAF evaluation more broadly than a custom Skip rule and can make the custom rule appear not to fire.

References

• Cloudflare WAF Skip action
• Cloudflare IP allowlist example