Custom URL Block

What It Means

The URL path of this request matches a path on your WAF’s blocklist. Blocks from your other custom rules have their own labels: Custom IP Block, Custom User-Agent Block, Custom Referrer Block, and Custom Cookie Block.

Why It Matters

Custom URL blocks give you direct control over which URL paths are accessible on your application. You can block specific pages, API endpoints, or URL patterns that you want to restrict.

Common Triggers

Requests to URL paths that match rules you or your team have configured in the WAF dashboard. This could include deprecated endpoints, internal paths, or URLs you want to restrict for business or security reasons.

What To Do

If this block is unexpected, review your custom URL rules on the Path Rules > Block page of the WAF dashboard. A team member may have added the rule previously. Rules cannot be edited in place, but they can be removed and re-added; if the block is no longer needed, remove the rule from that page.

Begins With and Equals Rules Start With a Slash

Begins With and Equals rules match from the start of the request path, and every request path starts with /. A rule saved as private (with no leading slash) never blocks anything; /private blocks /private and everything under it. When you add a Begins With or Equals rule on the Path Rules > Block page, the dashboard adds a missing / and strips a pasted URL down to its path, and the message after adding shows the exact path that was saved. Contains and Ends With rules don’t need the slash: wp-login as Contains matches /wp-login.php.

Contains Rules Also Match the Query String

A Contains rule matches anywhere in the full URL, including the query string, and is case-sensitive. sessionid as Contains blocks /login?sessionid=abc and /search?q=sessionid, but not /login?SESSIONID=abc. To cover different capitalizations, add a rule for each one.

A Period Matches Any Character

In a path rule, a . matches any single character, not only a period, and there’s no way to make it match a literal period only. A Contains rule for .env also blocks /environment, and an Ends With rule for .php also blocks /info-php. If a block looks unexpected, check whether a . in one of your rules is matching a different character. When you add a Contains or Ends With rule with a . in it, the message after adding points this out.