Every rule below is declared in HCL and applied with terraform apply — the WAF rules, the
rate limit, the cache rule, the zone TLS settings, Turnstile, and this Worker with its bindings.
The table is not hand-written: it is rendered from a POSTURE binding that Terraform fills
with jsonencode() of the same locals the rulesets consume, so the page cannot drift from
what was actually applied.
Zone diogodebastos.com on the Free plan. The zone hosts two apps:
the main site on the apex and www (owned by wrangler), and Edge Guard on
edge-guard.diogodebastos.com (owned by Terraform). Rules marked
host-scoped only match Edge Guard; rules marked
zone-wide deliberately protect the whole zone, main site included.
| Phase | Scope | Expression | Action | Description |
|---|---|---|---|---|
http_request_firewall_custom |
zone-wide | (starts_with(http.request.uri.path, "/wp-admin")) or (http.request.uri.path eq "/wp-login.php") or (ends_with(http.request.uri.path, "/.env")) or (starts_with(http.request.uri.path, "/.env")) |
block | Zone-wide: block common CMS and credential probes |
http_request_firewall_custom |
host-scoped | (http.host eq "edge-guard.diogodebastos.com" and any(http.request.headers["x-edge-guard-test"][*] eq "block")) |
block | Edge Guard: block the demo test header |
http_request_firewall_custom |
host-scoped | (http.host eq "edge-guard.diogodebastos.com" and (lower(http.user_agent) contains "sqlmap" or lower(http.user_agent) contains "nikto" or lower(http.user_agent) contains "masscan" or lower(http.user_agent) contains "nmap")) |
managed_challenge | Edge Guard: managed challenge for known scanner user agents |
http_request_firewall_custom |
host-scoped | (http.host eq "edge-guard.diogodebastos.com" and ip.src.country eq "T1") |
managed_challenge | Edge Guard: managed challenge for Tor exits (country T1), never a block |
http_ratelimit |
host-scoped | (http.host eq "edge-guard.diogodebastos.com" and starts_with(http.request.uri.path, "/api/ping")) |
block (5 req / 10s per IP, 10s timeout) | Edge Guard: rate limit /api/ping per IP |
http_request_cache_settings |
host-scoped | (http.host eq "edge-guard.diogodebastos.com" and starts_with(http.request.uri.path, "/static/")) |
set_cache_settings (edge TTL 300s) | Edge Guard: cache /static/* at the edge for 5 minutes |
Bot Fight Mode cannot be scoped to one hostname on Free, so it also covers the main site.
L3-L7 DDoS managed rulesets are always on and unmetered on every plan. Overrides need Enterprise + Advanced DDoS, so none are declared.
These buttons hit this zone from your browser. The status code comes back from Cloudflare's edge, not from this page.
Both endpoints are protected by Turnstile in managed mode and verified server-side with
siteverify before the model is ever called. Model: @cf/meta/llama-3.3-70b-instruct-fp8-fast.