Skip to main content
The web application firewall (WAF) is Cloudflare’s WAF, which Sevalla runs on every Sevalla domain and custom domain. It checks each HTTP and HTTPS request to your applications, static sites and load balancers at Cloudflare’s edge, and blocks the requests that match its rules before they reach your service. Sevalla manages the rules: the firewall is always on, has no setting, and you can’t change it.

​
How it works

Every request to an application, static site or load balancer, on its Sevalla domain or on a custom domain, enters Cloudflare’s network first. There, the firewall checks it against two sets of rules: A blocked request gets Cloudflare’s default block page, with status 403 and a Ray ID, and never reaches your service. The firewall works alongside DDoS protection: DDoS protection absorbs floods of traffic, and the firewall looks at what each request contains.

​
What is covered

​
Who manages the rules

Sevalla manages the firewall and its rules for every service. Nothing in the dashboard, the API or the CLI turns it off, shows its rules, or adds or changes a rule for a service or a domain. Contact support when the firewall blocks requests it shouldn’t, or when you need information about its rules, for example for a security review. In the dashboard, click Support in the top bar. See Get help.

​
Report a blocked request

1

Collect the details

Note the full URL, the HTTP method, the time with its time zone, the IP address of the client that sent the request, and the Ray ID. The Ray ID is on Cloudflare’s block page and in the CF-Ray response header. For a form submission or an API call, describe what the request body contained, without passwords, tokens or other secrets.
2

Contact support

In the dashboard, click Support in the top bar, say that the web application firewall blocked the request, and paste the details.
After support replies, send the same request again. When the firewall lets it through, your service answers it instead of Cloudflare’s block page.

​
Add your own restrictions

You can’t change the firewall, but you can limit who reaches an application. Set IP restrictions on its Networking tab to allow only the addresses and CIDR blocks you list, or to block them. Sevalla checks each request at Cloudflare’s edge and answers blocked ones with a plain 403 Forbidden, not Cloudflare’s block page.