Cloudflare Docs
Cloudflare Zero Trust
Visit Cloudflare Zero Trust on GitHub
Set theme to dark (⇧+D)

Common HTTP policies

The following policies are commonly used to secure HTTP traffic.

Refer to the HTTP policies page for a comprehensive list of other selectors, operators, and actions.

​​ Block sites

Block attempts to reach sites by hostname or URL paths. Different approaches may be required based on how a site is organized.

​​ Block sites by hostname

Block all subdomains that use a host.

SelectorOperatorValueAction
Hostmatches regex.*example\.comBlock

​​ Block sites by URL

Block a section of a site without blocking the entire site. For example, you can block a specific subreddit, such as reddit.com/r/gaming, without blocking reddit.com.

SelectorOperatorValueAction
URLmatches regex/r/gamingBlock

​​ Block content categories

Block content categories which go against your organization’s acceptable use policy.

SelectorOperatorValueAction
Content categoriesinAdult Themes, GamblingBlock

​​ Block unauthorized applications

To minimize the risk of shadow IT, some organizations choose to limit their users’ access to certain web-based tools and applications. For example, the following policy blocks AI assistants:

SelectorOperatorValueAction
ApplicationinChatGPT, BardBlock

​​ Check user identity

Configure access on a per user or group basis by adding identity-based conditions to your policies.

SelectorOperatorValueLogicAction
ApplicationinSalesforceAndBlock
User Group NamesinContractors

​​ Skip inspection for groups of applications

Certain client applications, such as Zoom or Apple services, rely on certificate pinning. The TLS inspection performed by Cloudflare Gateway will cause errors when users visit those applications. To avoid this behavior, you must add a Do Not Inspect HTTP policy.

Gateway evaluates Do Not Inspect policies first. We recommend moving your Do Not Inspect policies to the top of the list to reduce confusion.

SelectorOperatorValueAction
ApplicationinDo Not InspectDo Not Inspect

​​ Enforce device posture

Require devices to have certain software installed or other configuration attributes. For instructions on setting up a device posture check, refer to the device posture section.

SelectorOperatorValueAction
Passed Device Posture ChecksinMinimum OS versionAllow

​​ Enforce session duration

Require users to re-authenticate after a certain amount of time has elapsed.

​​ Isolate high risk sites in remote browser

If you are using the Browser Isolation add-on, refer to our list of common Isolate policies.

​​ Bypass inspection for self-signed certificates

When accessing origin servers with certificates not signed by a public certificate authority, you must bypass TLS decryption.

SelectorOperatorValueAction
Domainininternal.site.comDo Not Inspect

​​ Block file types

Block the upload or download of files based on their type.

SelectorOperatorValueLogicAction
Upload File TypeinMicrosoft Office Word Document (docx)AndBlock
Download File TypeinPDF (pdf)

​​ Block Google services

To enable Gateway inspection for Google Drive traffic, you must add the Cloudflare certificate to Google Drive.

​​ Block Google Drive uploads

Block file uploads to Google Drive.

SelectorOperatorValueLogicAction
ApplicationinGoogle DriveAndBlock
Upload Mime Typematches regex.*

​​ Block Google Drive downloads

Block file downloads from Google Drive.

SelectorOperatorValueLogicAction
ApplicationinGoogle DriveAndBlock
URL Path & Querymatches regex.*(e=download|export).*

​​ Block Gmail downloads

Block file downloads from Gmail.

SelectorOperatorValueLogicAction
Hostismail-attachment.googleusercontent.comAndBlock
URL Path & Queryis/attachment/u/0