Open the CDN zone → WAF tab in my.cubepath.com.

WAF rules control who can reach your content and how much traffic they can send. They run at the edge, so abusive requests are stopped before they touch your origin — which saves your bandwidth and protects your application even while an attack is in progress.

Like Edge Rules, each WAF rule has a priority (lower numbers run first), optional matching conditions, an on/off switch and an optional expiry date.

Matching conditions

A rule can target a subset of traffic or all of it. Match by path, HTTP method, host, headers, query parameters, cookies, country, IP or network range (CIDR), and User Agent. Leave the conditions empty and the rule applies to the whole zone.

Rule types

Block or Allow by IP

Block specific addresses or whole network ranges (CIDR), or build an allow list so only addresses you trust reach the zone. Use it to ban an abusive source, or to lock a staging zone down to your office network.

Block or Allow by Country

Allow or block visitors by the country their IP belongs to, using two-letter codes. Use it for regional requirements, or to cut traffic from places you don't serve.

Block by User Agent

Block requests whose User Agent matches patterns you define — common scraping tools, unwanted crawlers. Worth knowing: it discourages badly behaved bots rather than stopping determined ones, since a User Agent is trivially forged.

Rate Limit

Caps how many requests a visitor can make in a time window. You set the number of requests, the period in seconds, and whether the count is per IP, per IP and host, or globally for the zone. Over the limit, further requests are rejected until the window resets.

This is the rule that protects login pages, forms and APIs from brute force and floods.

JavaScript Challenge

Asks the browser to silently solve a small challenge before content is served. Real browsers pass without the visitor noticing; simple bots and scripts fail. Use it on pages that attract automated abuse but must stay open to the public.

Limit Download Speed

Caps download speed for matching content in kB/s, with an optional burst so the start of a file downloads at full speed before the cap applies. Keeps a handful of large downloads from saturating your bandwidth.

Limit Requests

Caps requests per second from a single IP, with an optional burst for short spikes. A lighter, per-second companion to Rate Limit — good for smoothing bursty traffic rather than blocking it.

Limit Connections

Caps how many simultaneous connections one IP can hold open. Stops a single client from tying up resources with many parallel connections.

Limit Bandwidth

Sets a monthly ceiling in GB for the matching traffic. Use it to keep one zone or one path from running away with your transfer budget.

Good practice

  • Allow lists for private zones, block lists for fighting specific abuse. If a zone should only be reachable by your team, listing what's allowed is far more robust than chasing what isn't.
  • Combine a rate limit with a JavaScript challenge on login and signup pages. Together they stop the overwhelming majority of credential-stuffing traffic.
  • Start rate limits generous and tighten them while watching analytics. A limit set too tight on the first try blocks real customers, and you'll hear about it before you notice it.
  • Use the expiry date for incident-time blocks, so temporary rules clean themselves up instead of quietly outliving the problem.