How do I apply a Cloudflare WAF rule to one URL path?

Definition: A Cloudflare web application firewall (WAF) custom rule applies an action to requests that match an expression. A condition on http.request.uri.path limits the rule to a selected path or content section; a hostname condition narrows it to a particular host.

Key facts

• As of 17 October 2026, Cloudflare's custom rules documentation describes a rule as an expression paired with an action, such as Block or Managed Challenge.
• Cloudflare's path field reference defines http.request.uri.path as the request's URI path and gives /articles/index as an example.
• Cloudflare's functions reference defines starts_with() as a test for a string beginning with a specified substring.
• Cloudflare's operator documentation identifies eq as equality and documents case-sensitive string comparison.

How does a rule target one exact path?

An exact path condition uses eq. Cloudflare's hostname field reference defines http.host as the hostname in the request URI, using the original client request's Host header.

The following illustrative expression combines the documented hostname and path fields. It selects /articles/index on www.example.org:

(http.host eq "www.example.org" and
 http.request.uri.path eq "/articles/index")

The hostname and path values are placeholders for the site's intended target. With the Block action, this expression refuses matching requests. A request for /articles/index/ has a different path value and falls outside this equality condition.

How does a rule cover a whole content section?

Cloudflare's functions documentation defines starts_with() as a prefix test. Applying that definition, the following illustrative expression covers the /articles section root and paths beginning with /articles/:

(http.host eq "www.example.org" and
 (http.request.uri.path eq "/articles" or
  starts_with(http.request.uri.path, "/articles/")))

Here, /articles, /articles/, and /articles/index match on the specified hostname. The trailing slash in the prefix keeps /articles-other outside this condition. A prefix of /articles alone would also select that sibling path.

Cloudflare's grouping documentation explains how parentheses control evaluation order. The inner parentheses keep both path alternatives under the hostname condition. The same documentation specifies that grouped expressions require the Expression Editor or API.

Where is the expression deployed?

Cloudflare's dashboard guide places custom rule creation under Security rules > Create rule > Custom rules. The Expression Editor accommodates the grouped expressions above. Under Then take action, the selected action determines what happens to matching requests; Deploy saves and deploys the rule.

For validation before enforcement, the guide documents the Log action for Enterprise plans. A path condition alone selects all matching requests. A crawler-specific restriction therefore needs an additional request condition joined with and, grouped so it applies to the entire selected section.

How are matches checked?

Cloudflare's Security Events documentation describes Sampled logs as a subset of security events. Expanding an event exposes its details, and Add filter narrows the displayed data by field, operator, and value.

For the section expression, a practical check compares requests to /articles, /articles/index, and /articles-other on the intended hostname. Those examples exercise the exact root, the slash-delimited prefix, and an excluded sibling. Event details help establish whether the intended rule and action handle the matching requests. Sampling means an individual event may be absent from the displayed list.

Related terms

• How does Cloudflare evaluate the order of custom WAF rules?
• How do I create a skip rule in Cloudflare's WAF?
• How do I match a user agent in a Cloudflare custom rule?

FAQ

Does a path-only Block rule affect human visitors?

Yes. Cloudflare's custom rules documentation ties the action to the matching expression. If you select only a path, human requests matching that path also receive the action.

Does capitalization affect matching?

Yes. Cloudflare's string comparison documentation specifies case-sensitive comparison. You should include the intended capitalization when defining a path condition; /Articles differs from /articles.

Sources

1. Cloudflare, "Custom rules", 16 October 2026
2. Cloudflare, "http.request.uri.path", undated
3. Cloudflare, "http.host", undated
4. Cloudflare, "Functions", 14 October 2026
5. Cloudflare, "Operators and grouping symbols", 1 October 2026
6. Cloudflare, "Create a custom rule in the dashboard", 8 October 2026
7. Cloudflare, "Security Events", 2 October 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer