Cloudflare WAF Rule: Trigger CAPTCHA Only on Ampersand-Containing Search URLs
Simon Willison's Weblog42 days agoTutorialSimon Willison was frustrated that even simple single-term searches on his site were triggering Cloudflare CAPTCHA challenges meant to deter aggressive crawlers. With help from Claude Code, he crafted a Cloudflare WAF Managed Challenge rule that activates only when a search URL contains at least one ampersand — the character that separates multiple query parameters. The result: ordinary searches like /search/?q=lemur pass through freely, while complex faceted queries with multiple parameters still face the challenge.
Turning Cloudflare’s threat indicators into real-time WAF rules
Cloudflare Blog50 days agoReleaseCloudflare customers can now apply Cloudforce One threat intelligence inside the WAF to block high-risk traffic. New cf.intel fields let security teams automate protections based on specific threat actors and targeted industries. The update turns threat indicators into real-time enforcement signals, reducing the gap between intelligence and active blocking.