Setting the file. One moment.
Chapter 04 · Cloudflare Deploy
Subchapter 4.79
references/ddos/gotchas.mdMarkdown4 KBView on GitHub
Cause: Sensitivity too high, wrong action, or missing exceptions
Solution:
log action first to validate (Enterprise Advanced)Cause: Sensitivity too low or wrong action
Solution: Increase to default sensitivity and use block action:
const config = {
rules: [{
expression: "true",
action: "execute",
action_parameters: { id: managedRulesetId, overrides: { sensitivity_level: "default", action: "block" } },
}],
};Cause: Insufficient traffic history (needs 7 days)
Solution: Wait for baseline to establish, check dashboard for adaptive rule status
Cause: Account overrides conflict with zone overrides
Solution: Configure at zone level OR remove zone overrides to use account-level
Cause: Not on Enterprise Advanced DDoS plan
Solution: Use managed_challenge with low sensitivity for testing
Cause: Too many override rules (Free/Pro/Business: 1, Enterprise Advanced: 10)
Solution: Combine conditions in single expression using and/or
Cause: Rule is read-only
Solution: Check API response for read-only indicator, use different rule
Cause: DDoS managed rulesets cannot be fully disabled (always-on protection)
Solution: Set sensitivity_level: "eoff" for minimal mitigation
Cause: Custom expressions require Enterprise Advanced plan
Solution: Use expression: "true" for all traffic, or upgrade plan
Cause: Zone/account doesn’t have DDoS managed ruleset, or incorrect phase
Solution: Verify ruleset exists via client.rulesets.list(), check phase name (ddos_l7 or ddos_l4)
| Error Code | Message | Cause | Solution |
|---|---|---|---|
| 10000 | Authentication error | Invalid/missing API token | Check token has DDoS permissions |
| 81000 | Ruleset validation failed | Invalid rule structure | Verify action_parameters.id is managed ruleset ID |
| 81020 | Expression not allowed | Custom expressions on wrong plan | Use "true" or upgrade to Enterprise Advanced |
| 81021 | Rule limit exceeded | Too many override rules | Reduce rules or upgrade (Enterprise Advanced: 10) |
| 81022 | Invalid sensitivity level | Wrong sensitivity value | Use: default, medium, low, eoff |
| 81023 | Invalid action | Wrong action for plan | Enterprise Advanced only: log action |
| Resource/Limit | Free/Pro/Business | Enterprise | Enterprise Advanced |
|---|---|---|---|
| Override rules per zone | 1 | 1 | 10 |
| Custom expressions | ✗ | ✗ | ✓ |
| Log action | ✗ | ✗ | ✓ |
| Adaptive DDoS | ✗ | ✓ | ✓ |
| Traffic history required | - | 7 days | 7 days |
log action + medium sensitivitydefault sensitivitylog → managed_challenge → blockSee patterns.md for progressive rollout examples.