Implementing Page Rules for Security: A Developer's Guide

Previously in this course, we covered Configuring SSL/TLS Settings: Securing Your Cloudflare Traffic, where we established the basics of encrypted connections. While global settings handle your entire domain, you often need more surgical control over specific URL patterns. That is where Page Rules come in.

Page Rules allow you to define custom behavior for specific URLs, providing a powerful way to override default settings and enforce security policies at the edge.

Understanding Page Rules from First Principles

In the Cloudflare ecosystem, Page Rules act as a "programmable" layer on top of your site's global configuration. When a request hits the Cloudflare edge, the system checks if the requested URL matches any of your defined Page Rule patterns. If a match is found, the associated settings are applied immediately.

Think of it as a conditional configuration engine. Because these rules execute at the edge, they prevent unauthorized or insecure traffic from ever reaching your origin server, saving bandwidth and compute resources.

Creating Your First Page Rules

To manage Page Rules, navigate to your domain in the Cloudflare dashboard and look for the "Rules" tab. You can define a URL pattern using wildcards (*). For example, example.com/* matches everything on your domain.

1. Forcing HTTPS

Even if you have SSL enabled, you want to ensure all users are forced onto an encrypted connection.

• URL: yourdomain.com/*
• Setting: "Always Use HTTPS" -> On

This rule instructs Cloudflare to automatically redirect any HTTP request to the HTTPS version of the same URL.

2. Redirecting Non-WWW to WWW

Standardizing your domain is critical for SEO and session consistency. You can use a Page Rule to ensure all traffic hits your preferred canonical version.

• URL: yourdomain.com/*
• Setting: "Forwarding URL" -> 301 - Permanent Redirect
• Destination: https://www.yourdomain.com/$1

The $1 acts as a capture group, ensuring the path and query string from the original request are preserved in the redirect.

3. Implementing Security Levels

If you have a specific administrative or login path (e.g., /admin/*), you may want to enforce stricter security than the rest of your site.

• URL: yourdomain.com/admin/*
• Setting: "Security Level" -> High

Setting the security level to "High" increases the sensitivity of the challenge pages (like CAPTCHA) shown to visitors, providing an extra layer of protection for your most sensitive endpoints.

Hands-On Exercise

1. Open your Cloudflare dashboard and navigate to Rules > Page Rules.
2. Create a rule to force HTTPS for all traffic on your site using the * wildcard.
3. Create a second rule to redirect all non-www traffic to the www version of your site.
4. Verify the redirect by opening your site in an Incognito window without the www prefix and observing the browser address bar.

Common Pitfalls

• Rule Order Matters: Page Rules are processed in order from top to bottom. If you have two rules that conflict, the one higher in the list wins. Always drag your most specific rules to the top.
• Over-matching: Using * too broadly can lead to unintended side effects. For example, if you have a webhook that requires HTTP, a global "Always Use HTTPS" rule might break it. Always test your rules in a staging environment if possible.
• Infinite Redirects: Be careful when creating forwarding rules. Ensure your destination URL is different from your trigger URL to avoid creating an infinite loop that crashes the visitor's browser.

FAQ

Are Page Rules being replaced? Cloudflare is gradually moving toward "Cloudflare Rules" (Transform Rules, Cache Rules, etc.), which are more granular. However, Page Rules remain a simple and effective tool for basic redirects and security overrides.

Do Page Rules affect my origin server? No. Because these rules are processed at the Cloudflare edge, your origin server never sees the HTTP request if it's being redirected or blocked by a Page Rule.

Recap

Page Rules give you precise control over your traffic flow. By forcing HTTPS, standardizing domain names with redirects, and tightening security levels on sensitive paths, you significantly harden your application's edge perimeter. Remember that order matters, and always test your redirects to ensure they don't cause loops.

Up next: Global Network and Edge Caching, where we will dive into how the Cloudflare CDN actually stores and delivers your content to users worldwide.