> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sevalla.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These are the docs for Sevalla, a platform for deploying applications, databases, static sites, object storage and load balancers. The dashboard is at https://app.sevalla.com.
> Bold text in steps is an exact dashboard label.
> To act on a Sevalla account, prefer the Sevalla MCP server (https://mcp.sevalla.com/mcp, see https://docs.sevalla.com/ai-agents/overview.md), then the Sevalla CLI (https://docs.sevalla.com/developer-tools/cli.md), then the REST API (https://api-docs.sevalla.com, OpenAPI spec at https://api.sevalla.com/v3/openapi.json).
> Every page index is at https://docs.sevalla.com/llms.txt.

# Web application firewall

> Cloudflare's web application firewall checks every request to Sevalla and custom domains with Cloudflare's managed rules and Sevalla's own. See what it covers and how to report a block.

The web application firewall (WAF) is Cloudflare's WAF, which Sevalla runs on every Sevalla domain and custom domain. It checks each HTTP and HTTPS request to your applications, static sites and load balancers at Cloudflare's edge, and blocks the requests that match its rules before they reach your service. Sevalla manages the rules: the firewall is always on, has no setting, and you can't change it.

## How it works

Every request to an application, static site or load balancer, on its Sevalla domain or on a custom domain, enters Cloudflare's network first. There, the firewall checks it against two sets of rules:

| Rules | Maintained by | What they do |
| - | - | - |
| Cloudflare's [managed rules](https://developers.cloudflare.com/waf/managed-rules/) | Cloudflare | Block common attacks and attempts to exploit known vulnerabilities. Cloudflare's security team updates them as new vulnerabilities appear. |
| Sevalla's custom rules | Sevalla | Rules Sevalla writes and maintains for the traffic on its platform, on top of Cloudflare's. |

A blocked request gets Cloudflare's default block page, with status `403` and a Ray ID, and never reaches your service.

The firewall works alongside [DDoS protection](https://docs.sevalla.com/security/ddos-protection.md): DDoS protection absorbs floods of traffic, and the firewall looks at what each request contains.

## What is covered

| Traffic | Checked by the firewall |
| - | - |
| Applications, on the Sevalla domain and custom domains | Yes |
| Static sites, on the Sevalla domain and custom domains | Yes |
| Load balancers, on the Sevalla domain and custom domains | Yes |
| TCP proxies and database external connections | No, they don't go through Cloudflare |
| Internal connections between your services | No, they stay on Sevalla's private network |

## Who manages the rules

Sevalla manages the firewall and its rules for every service. Nothing in the dashboard, the API or the CLI turns it off, shows its rules, or adds or changes a rule for a service or a domain.

Contact support when the firewall blocks requests it shouldn't, or when you need information about its rules, for example for a security review. In the dashboard, click **Support** in the top bar. See [Get help](https://docs.sevalla.com/support/get-help.md).

## Report a blocked request

**1. Collect the details**

Note the full URL, the HTTP method, the time with its time zone, the IP address of the client that sent the request, and the Ray ID. The Ray ID is on Cloudflare's block page and in the `CF-Ray` response header. For a form submission or an API call, describe what the request body contained, without passwords, tokens or other secrets.

**2. Contact support**

In the dashboard, click **Support** in the top bar, say that the web application firewall blocked the request, and paste the details.

After support replies, send the same request again. When the firewall lets it through, your service answers it instead of Cloudflare's block page.

## Add your own restrictions

You can't change the firewall, but you can limit who reaches an application. Set [IP restrictions](https://docs.sevalla.com/applications/networking.md#ip-restrictions) on its **Networking** tab to allow only the addresses and CIDR blocks you list, or to block them. Sevalla checks each request at Cloudflare's edge and answers blocked ones with a plain `403 Forbidden`, not Cloudflare's block page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.