WAF phases
The Web Application Firewall provides the following phases where you can create rulesets and rules:
http_request_firewall_customhttp_ratelimithttp_request_firewall_managed
These phases exist both at the account level and at the zone level. Considering the available phases and the two different levels, rules will be evaluated in the following order:
| WAF feature | Scope | Phase | Ruleset kind | Location in the dashboard |
|---|---|---|---|---|
| Custom rulesets | Account | http_request_firewall_custom | custom (create)root (deploy) | Account Home > Application Security > WAF > Custom rulesets |
| Custom rules | Zone | http_request_firewall_custom | zone | Your zone > Security > WAF > Custom rules |
| Rate limiting rules | Account | http_ratelimit | root | N/A |
| Rate limiting rules | Zone | http_ratelimit | zone | Your zone > Security > WAF > Rate limiting rules |
| WAF Managed Rulesets | Account | http_request_firewall_managed | root | Account Home > Application Security > WAF > Managed rulesets |
| WAF Managed Rulesets | Zone | http_request_firewall_managed | zone | Your zone > Security > WAF > Managed rules |
To learn more about phases, refer to Phases in the Ruleset Engine documentation.