skills.rest
kiurakku
kiurakkuCOMMUNITY
Explore all skills by this author →
𝕏@thefear078GitHub

waf-review

Review Cloudflare WAF rules, rate limits, bot management, and origin exposure for edge security gaps.

15|3|Updated Jul 9, 2026
Search Tags:#rate limiting#security review#cloudflare#waf#bot management#ddos protection#edge security
One-click install
npx skills add https://github.com/kiurakku/cursor-kit-for-ai --skill waf-review-kiurakku
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: waf-review
Source: https://github.com/kiurakku/cursor-kit-for-ai/tree/main/plugins/security/skills/waf-review
Command: npx skills add https://github.com/kiurakku/cursor-kit-for-ai --skill waf-review-kiurakku

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Edge security configurations often contain hidden gaps: publicly reachable origins, misordered WAF rules, missing rate limits on login endpoints, and bot rules that block legitimate traffic. This Skill provides a structured audit of Cloudflare edge protection so misconfigurations are found before attackers find them. ## Core Features & Use Cases - Exposure Audit: Verify the origin IP is hidden behind Cloudflare, TLS is Full (strict), and subdomains are properly proxied before reviewing any rules. - Layered Rule Review: Check managed rulesets, custom WAF expressions, per-endpoint rate limiting, bot posture, and Workers security with concrete rule examples and ordering guidance. - Use Case: Before launching a SaaS app on Cloudflare, run this review to confirm the origin firewall only allows Cloudflare IPs, /login has per-IP and per-account rate limits, and webhook routes are exempted from challenges so Stripe events are not lost. ## Quick Start Review my Cloudflare zone configuration and WAF rules for security gaps and produce an edge security report.

Frequently Asked Questions about waf-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Cloudflare WAF rules for security gaps?▼

Start with an exposure audit confirming the origin only accepts Cloudflare IP ranges, then review managed rulesets in Log mode before enforcing, and check custom rules for correct ordering. Allow rules for known-good automation must precede challenge rules to avoid breaking webhooks.

How to configure rate limiting for login endpoints in Cloudflare?▼

Set roughly 5 requests per minute per IP on /login, /register, and password reset endpoints, with tighter limits of 3-5 per minute on token or OTP verification. Pair edge limits with app-side per-account throttling since distributed credential stuffing bypasses per-IP rules.

Why is my Cloudflare WAF not protecting my origin server?▼

A WAF is ineffective if the origin IP is publicly reachable, since attackers bypass Cloudflare entirely. Lock the origin firewall to Cloudflare IP ranges or use a Tunnel, and check DNS history, mail records, and old subdomains for IP leaks.

Does Cloudflare bot management block legitimate traffic?▼

Yes, if misconfigured. Verified bots like Google, Stripe, and uptime monitors must be allowed, and API routes consumed by non-browser clients should use token auth plus rate limits instead of challenges. Blocking Googlebot is self-inflicted denial of service.

What are the limitations of relying only on a WAF for security?▼

A WAF filters traffic volume but never replaces application-side input validation, authentication, and rate checks. Any design treating the edge as the only defense layer should be flagged, since app-level enforcement remains the source of truth.

Related Skills

Explore More Software Engineering Skills→
majesticlabs-devmajesticlabs-dev
47

cloudflare-coder

Automate Cloudflare provisioning with OpenTofu/Terraform for zones, DNS, SSL, WAF, and caching.

Official
Advanced
xalgordxalgord
954

implementing-cloud-waf-rules

Deploy and tune WAF rules on AWS WAF, Azure WAF, and Cloudflare against OWASP Top 10 attacks.

Community
Intermediate
toplyr-narfurtoplyr-narfur

network-security-advanced

Harden VPS security for Urbit deployments with SSH, firewall, and intrusion detection.

Community
Advanced
curiositechcuriositech
2

reverse-proxy-for-agents

Route and secure AI agent HTTP, WebSocket, and LLM-router traffic with reverse proxy configurations.

Official
Advanced