Managed rulesets or custom rules: what each one is for

Managed rulesets or custom rules: what each one is for

Managed rulesets are pattern libraries maintained by Cloudflare: SQL injection signatures, known exploit paths, bad user agents. Custom rules are expressions you write yourself.

Where managed rules shine: generic attack noise you'd otherwise never keep up with. Turn them on, keep the sensitivity at the default, and review the events weekly.

Where they fail: anything specific to your application. They don't know that your API accepts JSON bodies with SQL-looking strings, or that your CMS uses a path that resembles a known exploit.

Where custom rules shine: protecting your login, your checkout, your form endpoints, your affiliate tracking links. Business logic that only you understand.

The combination that works: managed rules on with a handful of exceptions, custom rules for the five or six paths that actually matter, rate limiting on top of the custom rules. Don't try to write your own signature library. Don't expect the managed one to know your business.