Rule categories
The main categories (or tags) of HTTP DDoS Attack Protection managed rules are the following:
| Name | Description |
|---|---|
botnets | Rules for requests from known botnets, with very high accuracy and low risk of false positives. It is recommended that you keep these rules enabled. |
unusual-requests | Rules for requests with suspicious characteristics that are not usually seen in legitimate traffic. |
advanced | Rules related to features available to Advanced DDoS Protection customers, such as Adaptive DDoS Protection. |
generic | Rules for detecting and mitigating floods of requests. These rules are useful for mitigating attacks that have no known signatures, but they may also trigger on unusually high volumes of legitimate traffic. To reduce the risk of false positives, their request per second (rps) activation threshold is higher. These rules either rate-limit or challenge traffic by default, but you can override them to block traffic if necessary. |
read-only | Highly targeted rules for mitigating DDoS attacks with a high confidence rate. These rules are read-only — you cannot override their sensitivity level or action. |
test | Rules used for testing the detection, mitigation, and alerting capabilities of Cloudflare’s DDoS protection products. |