Skip to content

HTTP policies

HTTP policies allow you to intercept all HTTP and HTTPS requests and either block, allow, or override specific elements such as websites, IP addresses, and file types. HTTP policies operate on Layer 7 for all TCP (and optionally UDP) traffic sent over ports 80 and 443.

An HTTP policy consists of an Action as well as a logical expression that determines the scope of the policy. To build an expression, you need to choose a Selector and an Operator, and enter a value or range of values in the Value field. You can use And and Or logical operators to evaluate multiple conditions.

If a condition in an expression joins a query attribute (such as Source IP) and a response attribute (such as Resolved IP), then the condition will be evaluated when the response is received.

Actions

Actions in HTTP policies allow you to choose what to do with a given set of elements (domains, IP addresses, file types, and so on). You can assign one action per policy.

Allow

API value: allow

Available selectors

Traffic

Identity

Device Posture

The Allow action allows outbound traffic to reach destinations you specify within the Selectors and Value fields. For example, the following configuration allows traffic to reach all websites we categorize as belonging to the Education content category:

SelectorOperatorValueAction
Content CategoriesinEducationAllow

Untrusted certificates

The Untrusted certificate action determines how to handle insecure requests.

OptionAction
ErrorDisplay Gateway error page. Matches the default behavior when no action is configured.
BlockDisplay block page as set in Zero Trust.
Pass throughBypass insecure connection warnings and seamlessly connect to the upstream. To use this feature, deploy a custom root certificate. For more information on what statuses are bypassed, refer to the troubleshooting FAQ.

Block

API value: block

Available selectors

Traffic

Identity

Device Posture

The Block action blocks outbound traffic from reaching destinations you specify within the Selectors and Value fields. For example, the following configuration blocks users from being able to upload any file type to Google Drive:

SelectorOperatorValueLogicAction
ApplicationinGoogle DriveAndBlock
Upload Mime Typematches regex.*

WARP client block notifications Early Access

Feature availability

WARP modesZero Trust plans
  • Gateway with WARP
  • Secure Web Gateway without DNS filtering
Enterprise
SystemAvailabilityMinimum WARP version
Windows2024.1.159.0
macOS2024.1.160.0
Linux
iOS1.3
Android1.4
ChromeOS1.4

Turn on Display block notification for WARP client to display notifications for Gateway block events. Blocked users will receive an operating system notification from the WARP client with a custom message you set. If you do not set a custom message, the WARP client will display a default message. Custom messages must be 100 characters or less.

Upon selecting the notification, WARP will direct your users to a block page. Optionally, you can direct users to a custom URL, such as an internal support form.

To turn on client notifications on macOS devices running DisplayLink software, you may have to allow system notifications when mirroring your display. For more information, refer to the macOS documentation.

Isolate

API value: isolate

Available selectors

Traffic

Identity

Device Posture

The Isolate action serves matched traffic to users via Cloudflare Browser Isolation. For more information on this action, refer to Isolation policies.

Do Not Isolate

API value: noisolate

Available selectors

Traffic

Identity

Device Posture

The Do Not Isolate action turns off browser isolation for matched traffic. For more information on this action, refer to Isolation policies.

Do Not Inspect

API value: off

Available selectors

Traffic

Identity

Device Posture

Do Not Inspect lets you bypass certain elements from inspection. To prevent Gateway from decrypting and inspecting HTTPS traffic, your policy must match against the Server Name Indicator (SNI) in the TLS header. When accessing a Do Not Inspect site in the browser, your browser may display a Your connection is not private warning, which you can proceed through to connect. For more information about applications which may require a Do Not Inspect policy, refer to TLS decryption limitations.

All Do Not Inspect rules are evaluated first, before any Allow or Block rules, to determine if decryption should occur. For more information, refer to Order of enforcement.

Do Not Scan

API value: noscan

Available selectors

Traffic

Identity

Device Posture

When an admin enables AV scanning for uploads and/or downloads, Gateway will scan every supported file. Admins can selectively choose to disable scanning by leveraging the HTTP rules. For example, to prevent AV scanning of files uploaded to or downloaded from example.com, an admin would configure the following rule:

SelectorOperatorValueAction
Hostnamematches regex.*example.comDo Not Scan

When a Do Not Scan rule matches, nothing is scanned, regardless of file size or whether the file type is supported or not.

Quarantine

API value: quarantine

Available selectors

Traffic

Identity

Device Posture

The Quarantine action sends files in matching requests to a file sandbox to scan for malware. Gateway will only quarantine files not previously seen in the file sandbox. For more information on this action, refer to File sandboxing.

Sandbox file types

In Sandbox file types, you can select which file types to quarantine with your policy. You must select at least one file type.

File sandboxing supports scanning the following file types:

Supported sandboxing file types

  • .com
  • .exe
  • .pdf
  • .doc
  • .docm
  • .docx
  • .rtf
  • .ppt
  • .pptx
  • .xls
  • .xlsm
  • .xlsx
  • .zip
  • .rar

Selectors

Gateway matches HTTP traffic against the following selectors, or criteria:

Application

You can apply HTTP policies to a growing list of popular web applications. Refer to Application and app types for more information.

UI nameAPI exampleEvaluation phase
Applicationany(app.ids[*] in {505})Before DNS resolution

Content Categories

UI nameAPI example
Content Categoriesnot(any(http.request.uri.content_category[*] in {1}))

For more information, refer to our list of content categories.

Destination Continent

The continent where the request is destined. Geolocation is determined from the target IP address. To specify a continent, enter its two-letter code into the Value field:

  • AF – Africa
  • AN – Antarctica
  • AS – Asia
  • EU – Europe
  • NA – North America
  • OC – Oceania
  • SA – South America
  • T1 – Tor network
UI nameAPI example
Destination Continent IP Geolocationhttp.dst_ip.geo.continent == “EU”

Destination Country

The country that the request is destined for. Geolocation is determined from the target IP address. To specify a country, enter its ISO 3166-1 Alpha 2 code in the Value field.

UI nameAPI example
Destination Country IP Geolocationhttp.dst_ip.geo.country == “RU”

Destination IP

UI nameAPI example
Destination IPhttp.dst.ip == "10.0.0.0/8"

Device Posture

With the Device Posture selector, admins can use signals from end-user devices to secure access to their internal and external resources. For example, a security admin can choose to limit all access to internal applications based on whether specific software is installed on a device and/or if the device or software are configured in a particular way.

For more information on device posture checks, refer to Device posture.

UI nameAPI example
Passed Device Posture Checksany(device_posture.checks.failed[*] in {"1308749e-fcfb-4ebc-b051-fe022b632644"}), any(device_posture.checks.passed[*] in {"1308749e-fcfb-4ebc-b051-fe022b632644"})"

Domain

Use this selector to match against a domain and all subdomains — for example, if you want to block example.com and subdomains such as www.example.com.

UI nameAPI example
Domainany(http.request.domains[*] == "example.com")

Download and Upload File Types

These selectors will scan file signatures in the HTTP body. You can select from file categories or specific file types, including executables, archives and compressed files, Microsoft 365/Office documents, and Adobe files.

UI nameAPI example
Download File Typesany(http.download.file.types[*] in {"docx" "7z"})
UI nameAPI example
Upload File Typesany(http.upload.file.types[*] in {"compressed"})

Download and Upload Mime Type

These selectors depend on the Content-Type header being present in the request (for uploads) or response (for downloads).

UI nameAPI example
Download Mime Typehttp.download.mime == "image/png\"
UI nameAPI example
Upload Mime Typehttp.upload.mime == "image/png\"

DLP Profile

Scans HTTP traffic for the presence of social security numbers and other PII. You must configure the DLP Profile before you can use this selector in your policy. For more information, refer to our DLP Profile documentation.

Host

Use this selector to match only the hostname specified — for example, if you want to block test.example.com but not example.com or www.test.example.com.

UI nameAPI example
Hosthttp.request.host == "test.example.com"

HTTP Method

UI nameAPI example
HTTP Methodhttp.request.method == "GET"

HTTP Response

UI nameAPI example
URLhttp.response.status_code == "200"

Proxy Endpoint

The proxy server where your browser forwards HTTP traffic.

UI nameAPI example
Proxy Endpointproxy.endpoint == "3ele0ss56t.proxy.cloudflare-gateway.com"

Security Risks

UI nameAPI example
Security Risksany(http.request.uri.category[*] in {1})

For more information, refer to our list of security categories.

Source Continent

The continent of the user making the request.

Geolocation is determined from the device’s public IP address (typically assigned by the user’s ISP). To specify a continent, enter its two-letter code into the Value field:

ContinentCode
AfricaAF
AntarcticaAN
AsiaAS
EuropeEU
North AmericaNA
OceaniaOC
South AmericaSA
Tor networkT1
UI nameAPI exampleEvaluation phase
Source Continent IP Geolocationhttp.src_ip.geo.continent == “North America”Before DNS resolution

Source Country

The country of the user making the request.

Geolocation is determined from the device’s public IP address (typically assigned by the user’s ISP). To specify a country, enter its ISO 3166-1 Alpha-2 code in the Value field.

UI nameAPI exampleEvaluation phase
Source Country IP Geolocationhttp.src_ip.geo.country == “RU”Before DNS resolution

Source Internal IP

Use this selector to apply HTTP policies to a private IP address, assigned by a user’s local network, that requests arrive to Gateway from. This selector will only apply to users connected through a Magic GRE or IPSec tunnel.

UI nameAPI example
Source Internal IPhttp.src.internal_src_ip == “192.168.86.0/27”

Source IP

UI nameAPI example
Source IPhttp.src.ip == "10.0.0.0/8"

URL

Gateway ignores trailing forward slashes (/) in URLs. For example, https://example.com and https://example.com/ will count as the same URL and may return a duplicate error.

UI nameAPI example
URLnot(any(http.request.uri.content_category[*] in {1}))

URL Path

UI nameAPI example
URL Pathhttp.request.uri.path == \"/foo/bar\"

URL Path and Query

UI nameAPI example
URL Path and Queryhttp.request.uri.path_and_query == \"/foo/bar?ab%242=%2A342\"

URL Query

UI nameAPI example
URL Querynot(http.request.uri in $%s)

Users

Identity-based selectors include:

  • SAML Attributes
  • User Email
  • User Group Emails
  • User Group IDs
  • User Group Names
  • User Name

To use identity-based selectors, enable Gateway with WARP in the Zero Trust WARP client and enroll your user in your organization. For more information, refer to Identity-based policies.

Virtual Network

Use this selector to match all traffic routed through a specific Tunnel Virtual Network via the WARP client.

UI nameAPI example
Virtual Networkhttp.conn.vnet_id == “957fc748-591a-e96s-a15d-1j90204a7923”

Comparison operators

Comparison operators are the way Gateway matches traffic to a selector. When you choose a Selector in the dashboard policy builder, the Operator dropdown menu will display the available options for that selector.

OperatorMeaning
isequals the defined value
is notdoes not equal the defined value
inmatches at least one of the defined values
not indoes not match any of the defined values
in listin a pre-defined list of values
not in listnot in a pre-defined list of values
matches regexregex evaluates to true
does not match regexregex evaluates to false
greater thanexceeds the defined number
greater than or equal toexceeds or equals the defined number
less thanbelow the defined number
less than or equal tobelow or equals the defined number

Value

In the Value field, you can input a single value when using an equality comparison operator (such as is) or multiple values when using a containment comparison operator (such as in). Additionally, you can use regular expressions (or regex) to specify a range of values for supported selectors.

Regular expressions

Gateway uses Rust to evaluate regular expressions. The Rust implementation is slightly different than regex libraries used elsewhere. For more information, refer to our guide for Wildcards. To evaluate if your regex matches, you can use Rustexp.

If you want to match multiple values, you can use the pipe symbol (|) as an OR operator. In Gateway, you do not need to use an escape character (\) before the pipe symbol. For example, the following policy blocks requests to two hostnames if either appears in a request header:

SelectorOperatorValueAction
Hostmatches regex.\*whispersystems.org|.\*signal.orgBlock

In addition to regular expressions, you can use logical operators to match multiple values.

Logical operators

To evaluate multiple conditions in an expression, select the And logical operator. These expressions can be compared further with the Or logical operator.

OperatorMeaning
Andmatch all of the conditions in the expression
Ormatch any of the conditions in the expression

The Or operator will only work with conditions in the same expression group. For example, you cannot compare conditions in Traffic with conditions in Identity or Device Posture.

If a condition in an expression joins a request attribute (such as Source IP) and a response attribute (such as a DLP Profile), then the condition will be evaluated when the response is received.