Cloudflare Application Security key terms

The backend infrastructure that hosts the actual application content and generates responses. Protection services sit in front of it so attackers never reach it directly.

An intermediary that accepts client requests on behalf of a backend, forwarding them and returning the response. It hides origin addressing and enables centralized inspection and caching.

A routing scheme where many geographically dispersed servers announce the same IP address, so each client reaches the topologically nearest one. This spreads attack traffic and reduces latency.

The point where encrypted transport is decrypted so traffic can be inspected. It may occur at the edge or be passed through to the origin, depending on the configured mode.

A TLS configuration where the edge validates the origin's certificate against a trusted authority and requires a matching hostname, preventing decryption between edge and origin from being silently intercepted.

A trusted entity that issues and signs digital certificates binding a public key to a hostname. Browsers rely on these signatures to confirm server identity.

A browser rule that restricts scripts from one origin from reading data belonging to another origin. It is the foundation of client-side isolation in web applications.

An injection flaw where attacker-supplied script executes in a victim's browser within the trusted site's context, enabling session theft or data exfiltration. Output encoding and input validation are primary defenses.

An attack that tricks an authenticated user's browser into submitting an unwanted state-changing request to a site where they are logged in. Token checks and SameSite cookies mitigate it.

An attack that inserts database syntax into user-controlled input so the query executes unintended commands. Parameterized queries and signature-based filtering are standard countermeasures.

An open community that publishes widely used guidance on application security risks, including the Top Ten list and rule categories that many managed firewall rulesets are organized around.

An HTTP response header that tells the browser which sources of scripts, styles, and other resources are permitted, reducing the impact of injected content.

A volumetric attack made of seemingly valid HTTP requests that exhaust application or connection resources rather than bandwidth. Rate limiting and behavioral analysis are typical defenses.

A transport-layer attack that sends many connection-initiation packets without completing the handshake, filling the server's connection table. SYN cookies and upstream filtering counter it.

An attack whose goal is to saturate available bandwidth with sheer traffic volume, often using reflection or amplification. Absorbing it requires distributed capacity spread close to sources.

A technique that sends small spoofed requests to services that return much larger responses to the victim, multiplying the attacker's effective bandwidth.

An attack where responses are directed at a victim by forging the source address in requests to third-party services, hiding the attacker and concentrating traffic on the target.

Falsifying a packet's source address so replies go elsewhere. Ingress filtering and challenge mechanisms help distinguish forged traffic from legitimate clients.

An attack operating at the network or transport layer, targeting IP, TCP, or UDP behavior rather than application semantics. Mitigation relies on packet inspection and capacity.

An attack that mimics legitimate application traffic, such as repeated search queries or login attempts, making it hard to separate from real users without behavioral signals.

A facility that receives diverted traffic, filters out malicious packets, and forwards clean traffic onward. Diversion is typically triggered by detection thresholds or manual action.

A control that caps how many requests a client may make in a time window, protecting endpoints from brute force and floods while preserving service for normal users.

The globally distributed set of servers that terminates client connections, applies security policy, and caches content before requests reach the origin.

A policy engine that inspects HTTP requests and responses against rules and blocks those matching attack patterns or violating configured constraints.

A curated collection of firewall signatures maintained by the provider and updated as new vulnerabilities emerge, letting customers gain coverage without authoring rules.

A user-authored condition, typically expressed against request fields, that blocks, challenges, or logs matching traffic. It complements managed signatures with site-specific logic.

The syntax used to write rule conditions, combining request fields with operators and functions so policies can match on paths, headers, geography, or computed values.

A sensitivity setting for managed rules that determines how aggressively borderline signatures fire. Raising it increases detection but also the chance of blocking legitimate requests.

A legitimate request incorrectly flagged as malicious. Tuning rules, exclusions, and sensitivity settings reduces these without abandoning protection.

Malicious traffic that passes inspection undetected. Lowering sensitivity or loosening rules can increase these, so tuning trades one error type against the other.

A widely adopted open-source set of generic attack-detection signatures that many firewalls build on, covering injection, protocol anomalies, and known bad patterns.

A detection model that accumulates points as individual signatures match, blocking only when a threshold is crossed. It reduces noise compared with blocking on any single match.

An interstitial served to suspicious clients that must be solved before access is granted. Passing it issues a clearance token that subsequent requests present.

A token issued after a client satisfies a challenge, allowing later requests to skip repeated verification until it expires or is invalidated.

A mode where the platform chooses an appropriate verification method for each visitor based on risk signals, rather than forcing one fixed challenge type for everyone.

A numeric likelihood, typically 1 to 99, that a request originates from automated software. Policies use thresholds on this score to allow, challenge, or block.

Automated traffic whose operator has been validated by the platform, such as a known search crawler, so it can be permitted without being lumped in with unknown automation.

Detection based on how a client acts over time, including request timing, mouse movement, and navigation patterns, rather than on a single request's static attributes.

Collecting characteristics such as TLS handshake details, header ordering, and browser properties to distinguish clients even when they present identical user agents.

A request header identifying the client software. It is trivially forged, so it should be treated as a weak signal rather than proof of client identity.