Rules examples

Route requests with a URI path starting with /images to a specific AWS S3 bucket with Cloud Connector using Terraform.

Route requests with a URI path starting with /images to a specific AWS S3 bucket using Cloud Connector.

Route all traffic from EU visitors to a Google Cloud Storage bucket using Cloud Connector.

Route requests with a URI path starting with /static-assets to an Azure Blob Storage container using Cloud Connector.

Create a compression rule to turn off Brotli compression for all incoming requests of a given zone.

Create a compression rule to turn off compression for AVIF images, based on either the content type or the file extension specified in the request.

Create a compression rule to turn on Zstandard compression for response content types where Cloudflare applies compression by default.

Create a compression rule to set Gzip compression as the preferred compression method for CSV files.

Create a compression rule to set Brotli as the only supported compression algorithm for a specific URI path.

Create a configuration rule using Terraform to turn off Email Obfuscation and Browser Integrity Check for API requests in a given zone.

Create an origin rule to change the HTTP Host header and the resolved DNS record.

Create an origin rule to change the destination port.

Create an origin rule using Terraform to override the Host header, the resolved hostname, and the destination port of API requests.

Set up an A/B test by controlling what response is served based on cookies.

Dynamically set a cookie expiration and test group.

Allow or deny a request based on a known pre-shared key in a header. This is not meant to replace the WebCrypto API.

Send Bots information to your origin. Refer to Bot Management variables for a full list of available fields.

Use the bot score field to send bots to a honeypot.

Redirect requests to certain URLs based on a mapped object to the request's URL.

Redirect a response based on the country code in the header of a visitor.

Store, retrieve, and remove assets from cache programmatically. Use this template to optimize performance and implement custom caching strategies.

Send debugging information in an errored response to a logging service.

Adjust Cross-Origin Resource Sharing (CORS) headers and handle preflight requests.

Modify the fetch request to follow redirects from the origin, ensuring the client receives the final response.

Add a custom header to requests sent to the origin server with the current timestamp in hexadecimal format for debugging, tracking, or custom routing purposes.

Extract a JWT from the Authorization header, verify its HMAC-SHA256 signature using the WebCrypto API, and validate its claims.

Serve a custom maintenance page instead of fetching content from the origin server or cache. Ideal for downtime notifications, planned maintenance, or emergency messages.

Get a specific Set-Cookie header and update it with a certain value.

If origin responded with 403 Forbidden error code, redirect to different page.

Redirect all requests from one domain to another domain.

If origin responds with JSON, parse the response and delete fields to return a modified response.

Remove certain query strings from a request before passing to the origin.

Remove from response all headers that start with a certain name.

Respond with information about the incoming request provided by Cloudflare’s global network.

Dynamically rewrite links in HTML responses. This is useful for site migrations and branding updates.

Route requests to a different origin, prepend a directory to the URL path, and remove specific segments.

Set common security headers such as X-XSS-Protection, X-Frame-Options, and X-Content-Type-Options.

Convert timestamp to hexadecimal format and send it as a custom header to the origin.

If response to the original request is not 200 OK or a redirect, send to another origin.

Verify a signed request using the HMAC and SHA-256 algorithms or return a 403.

Define a delay to be used when incoming requests match a rule you consider suspicious based on the bot score.

Create a CORS response header transform rule to add an Access-Control-Allow-Origin HTTP header to the response with wildcard as static value. (cookiename=value).

Create a request header transform rule to add a X-Bot-Score HTTP header to the request with the current bot score.

Create a request header transform rule to add an X-Source HTTP header to the request with a static value (Cloudflare).

Create a request header transform rule to add an HTTP header when the Workers subrequest comes from a different zone.

Create a response header transform rule to add a set-cookie HTTP header to the response with a static value (cookiename=value).

Create a URL rewrite rule (part of Transform Rules) to normalize encoded forward slashes (%2F) in the request path to standard slashes (/).

Create a request header transform rule (part of Transform Rules) to remove the cf-connecting-ip HTTP header from the request.

Create a response header transform rule (part of Transform Rules) to remove the cf-connecting-ip HTTP header from the response.

Create a transform rule to rewrite the URL format /posts/<YYYY>-<MM>-<DD>-<TITLE> to the new format /posts/<YYYY>/<MM>/<DD>/<TITLE>.

Create a URL rewrite rule (part of Transform Rules) to rewrite everything under /blog/<PATH> to /marketing/<PATH>.

Create a URL rewrite rule (part of Transform Rules) to rewrite any requests for /news/2012/... URI paths to /archive/news/2012/....

Create a URL rewrite rule (part of Transform Rules) to rewrite any requests for /files/... URI paths to /....

Create a URL rewrite rule (part of Transform Rules) to rewrite any requests for /images/<FOLDER1>/<FOLDER2>/<FILENAME> to /img/<FILENAME>.

Create a transform rule to rewrite the request path from /blog to /blog?sort-by=date.

Create two URL rewrite rules (part of Transform Rules) to rewrite the path of the welcome page for visitors in specific countries.

Create a response header transform rule (part of Transform Rules) to set an X-Bot-Score HTTP header in the response with the current bot score.

Create a response header transform rule (part of Transform Rules) to set an X-Bot-Score HTTP header in the response to a static value (Cloudflare).

Create a redirect rule to redirect visitors using mobile devices to a different hostname.

Create a redirect rule to redirect requests for the administration area of store.example.com to HTTPS, keeping the original path and query string.

Create a redirect rule to redirect all requests to a different domain, maintaining all functionality, except for the discontinued HTTP service (port 80).

Create a redirect rule to redirect all website visitors from the United Kingdom to a different domain, maintaining the current functionality in the same paths.

Create a redirect rule to redirect all URLs for a domain to point to the root of a new domain, including any subdomains of the old domain.

Create a redirect rule to redirect all requests for smallshop.example.com to a different hostname using HTTPS, keeping the original path and query string.

Create a redirect rule to redirect United Kingdom and France visitors from the example.com website's root path (/) to their localized subdomains https://gb.example.com and https://fr.example.com, respectively.

Create a redirect rule to redirect visitors from /contact-us/ to the page's new path /contacts/.

Create a redirect rule to forward HTTPS requests from the root (also known as the “apex” or “naked” domain) to the WWW subdomain.

Create a redirect rule to forward HTTPS requests from the WWW subdomain to the root (also known as the “apex” or “naked” domain).

Create a redirect rule to redirect visitors from an old URL format with locale information to a new URL format.