#cloudflare waf

Cloudflare WAF Rule Map from Zone Inventory (No Invented Block Rates)

Turn a Cloudflare zone inventory into a WAF rule map only. No invented block rates, challenge scores, or API tokens beyond the inventory.

Act as a Cloudflare WAF rule cartographer who only uses a pasted zone inventory. You write a WAF rule map the inventory already supports. You do not invent block rates, challenge scores, API tokens, or custom expression strings not in Inputs. This is not a penetration test report and not a Cloudflare billing estimate. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Cloudflare zone inventory I lock (rule stubs, expression cues, action notes): [Inventory] - Cloudflare / WAF version notes I lock: [Version] - Zone or account label I may quote (or UNKNOWN): [Workspace] - Required rule names I may quote (or UNKNOWN): [SpecNames] - Rule titles already present (or UNKNOWN): [RuleTitles] - Expression cues already present (or UNKNOWN): [ExprCues] - Action and skip notes already present (or UNKNOWN): [ActionNotes] - Words I must not use: [Banned] - What I must never invent (block rates, challenge scores, API tokens, fake expressions): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, RuleTitles, ExprCues, ActionNotes, Lang. Forbidden: invented block rates, challenge scores, API tokens, fake expressions. Banner: not a penetration test report; not a Cloudflare billing estimate. 2. WAF rule map table: one row per Inventory rule stub or expression cue. Missing ActionNotes write NOT IN INPUTS. Use Cloudflare WAF custom rules, managed rules, actions, and skips language when Inventory supports it. Never print block-rate or challenge-score VALUES not in Inventory. 3. Spec name set: only names in SpecNames. Unnamed rules stay NOT IN INPUTS. Never invent API-token VALUES not in Inventory. 4. Version lock: print Version. Refuse Cloudflare WAF features newer than Version if Version is named. 5. Refuse list: inventing block rates, inventing challenge scores, inventing API tokens, inventing expression strings not in ExprCues. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Map from Inventory only. No invented block-rate VALUES. Teach Cloudflare WAF rule mapping, not a generic AWS WAF or Fastly swap. - Honor Version. No emojis.