Wondering how to handle Cloudflare waf false positives? We can help you.

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Service.

Let’s take a look at how our Support Team assist with this query.

How to handle Cloudflare waf false positives?

A false positive is an incorrect identification. In the case of DDoS protection, there is a false positive when legitimate traffic is mistakenly classified as attack traffic.

This can occur when legacy applications, Internet services, or faulty client applications generate legitimate traffic that appears suspicious, has odd traffic patterns, deviates from best practices, or violates protocols.

In these cases, Cloudflare’s DDoS Protection systems may flag that traffic as malicious and apply mitigation actions.

If the traffic is in fact legitimate and not part of an attack, the mitigation actions can cause service disruptions and outages to your Internet properties.

To remedy a false positive:

1. Log in to the Cloudflare dashboard and select your account.
2. Navigate to the analytics dashboard and apply filters to the displayed data.For WAF/CDN customersFor Magic Transit and Spectrum customers
3. Scroll down to the Activity log.
4. Click Edit columns and enable Rule ID*.
5. Copy the rule ID from one of the DDoS log entries.
6. Navigate to Security > DDoS and click Configure next to the Managed Ruleset containing the rule you will adjust.
7. Click Browse rules and paste the Rule ID in the search field.
8. Decrease the rule’s Sensitivity Level to Essentially Off or change the action of the rule to Log.
9. Click Next and then Save.

Once saved, the rule takes effect within one or two minutes.

The rule adjustment should provide immediate remedy, which you can view in the analytics dashboard .

[Looking for a solution to another query? We are just a click away.]

Conclusion

To sum up, our skilled Support Engineers at Bobcares demonstrated about Cloudflare waf false positives