---
title: "Custom WAF rule"
date: "2026-04-28T11:36:43+00:00"
summary: "Create, edit, and delete custom WAF rules to block or alert on traffic by IP, country, header, or path across your domains."
image:
type: "page"
url: "/acquia-cloud-platform/add-ons/edge-standard/custom-waf-rule"
id: "84444279-65ad-40b5-91c9-34edf95952ab"
---

Create, edit, and delete custom WAF rules to block or alert on traffic by IP, country, header, or path across your domains.

Create a custom WAF rule
------------------------

1.  In the Edge console, _go to Security > Rule configuration > Custom WAF rule._
2.  Select **Create custom rule**.
3.  In Set rule name, enter a descriptive Name for the rule.  
    Example: Block admin access from non-US countries
4.  Define how the rule identifies matching requests:
    *   In Attribute, select the request attribute to evaluate. Common options include:
        *   ASN
        *   Country
        *   Header
        *   IP address
        *   Method
        *   Query string
    *   In Criteria, select how the attribute should be matched. Available options depend on the attribute:

Criteria

Description

equals

The attribute value must exactly match the specified value.

contains

The attribute value must include the specified string.

range

The attribute value must fall within the specified range. An IP range is a common example.

wildcard

The attribute value must match the specified wildcard pattern, where \* matches any sequence of characters.

Regex

The attribute value must match the specified regular expression pattern. Uses RE2 syntax. The pattern is evaluated as a full match against the attribute value.

In Value, enter the value to match. Examples:

*   Country: US
*   IP address: 203.0.113.10
*   Header: User-Agent contains curl
*   Path (via query string or header, depending on attribute): /admin

You can combine different attributes and criteria by creating multiple custom rules.

5.  In the Response action, choose how the rule handles matching requests:
    *   Block – Stops the request from reaching your site.
    *   Alert – Allows the request but logs it for review in Security Metrics.
6.  In Rule priority, select where this rule sits relative to other custom rules, such as First, Last, or a specific position in the list. Higher-priority rules are evaluated first.  
    Tip: Start new rules in Alert mode and review their impact in Security Metrics before switching to Block.
7.  In Domains, choose where the rule applies:
    *   All domains, or
    *   A specific set of domains from the list.
8.  (Optional) In the Domain path, enter one or more paths (comma-separated) to further narrow where the rule applies.  
      
    Example: /login, /admin  
    When domain paths are set, the rule applies only to requests that match both the selected domains and one of the specified paths.
9.  Review the configuration summary.
10.  Select **Create rule**.

The rule deploys to the edge and begins evaluating requests shortly after you save.

Regex criteria
--------------

When you select regex as the criteria, the rule evaluates the attribute value against a regular expression pattern you provide.

### Syntax

Acquia Edge uses [Syntax](https://github.com/google/re2/wiki/Syntax) for regex patterns. RE2 is a safe, linear-time regex engine that does not support backreferences or lookahead/lookbehind assertions.

### How matching works

*   The engine evaluates the pattern as a full match against the attribute value. To match a substring, wrap your pattern with .\* on both sides. For example, to match any path containing /admin, use .\*\\/admin.\*.
*   Matching is case-sensitive by default.

### Tips for testing regex rules

*   Before switching a regex rule to Block mode, set the response action to Alert and review matching traffic in Security Metrics to confirm the pattern behaves as expected.
*   Use an RE2 validator to test your pattern before applying it. For example, use regex101.com with the RE2 flavor selected.
*   Keep patterns as specific as possible to avoid unintended matches.

Note

A known limitation exists where custom WAF rules using the regex criteria may not block matching requests as expected in certain configurations. Test your rule in Alert mode first to confirm it matches the intended traffic before switching to Block.

Edit a custom WAF rule
----------------------

1.  In the Edge console, _go to Security > Rule configuration > Custom WAF rule._
2.  In the row for the rule you want to change, _select Actions > Edit rule._
3.  Update any of the following:
    *   Name
    *   Attribute, Criteria, or Value
    *   Response action (Block or Alert)
    *   Rule priority
    *   Domains and _domain paths_
4.  Select **Update rule.**

Changes deploy to the edge after you save. Use Security Metrics to confirm that the updated rule behaves as expected.

Note

Security Metrics only reflect traffic matched by your custom WAF rules. Traffic blocked by _OWASP-managed_ rules is not visible in Security Metrics. If you are investigating blocked traffic that does not appear in Security Metrics, it may have been blocked by an OWASP rule. For more information, visit the [OWASP ruleset](/acquia-cloud-platform/add-ons/edge-standard/owasp-ruleset-0 "OWASP ruleset").

Delete a custom WAF rule
------------------------

1.  In the Edge console, _go to Security > Rule configuration > Custom WAF rule._
2.  In the row for the rule you want to remove, _select Actions > Delete rule_.
3.  Confirm that you want to delete the rule.

Once deleted, the rule no longer evaluates or blocks traffic. If you still need similar protection, create a replacement rule with the updated logic.