A zone holds every name of a registrable domain: example.com, www.example.com, api.example.com, shop.example.com… Each proxied name is a site at the edge. By default every name uses the zone's edge settings. A name can override some of them in hosts.<name>: its site is then the zone's settings with its own values on top.
- Nested objects (
access_gate,hsts,origin,cache,rum) merge field by field: a name can change onlyorigin.port. - Lists (
cors_allow_origins,redirect_allow_hosts,access_gate.emails…) are replaced whole. rate_rules,early_hintsandai_agentsof a name replace the zone's as a whole. The first time you change a name'sai_agentsorearly_hints, the fields you don't give are copied from the zone.
Up to 100 names per zone can have their own settings. A name must be the zone or below it. You can prepare settings for a name before it has a proxied record; the change then warns that the edge doesn't serve the name yet.
Keys a name can override
| Key | Notes |
|---|---|
mode, waf_level, stack, enable_feed, rate_limit_rpm | WAF settings |
block_page_mode, block_page_html, fake_server_header | Block page |
max_body_mb, timeout_ms, compression | WAF settings |
redirect_allow_hosts, cors_allow_origins | Lists, replaced whole. |
access_gate | enabled, path, ttl_hours, emails. |
hsts | max_age, include_subdomains, preload; see HSTS. |
origin | scheme, port, tls_verify, server_name, client_cert; see Origin TLS. |
cache, early_hints | See Cache. |
rum | See Analytics. |
rate_rules | The name's own list; its rules don't carry hosts. [] = no rules for this name. See Rate limiting. |
ai_agents | See AI Crawl Control settings. |
redirects and hosts can't be set inside a name: every redirect rule already names its host. An unknown key is rejected with 422.
Override a setting
On Security → Firewall, Security → Access gate and the other settings pages that show Applies to, pick a name instead of Whole domain (every name). Greyed values are inherited; Customize for this name gives the name its own value. Names lists every proxied name with the number of settings it customizes; Settings opens them.
openwaf-cloud ctl zones set example.com --host api.example.com stack=nextjs origin.port:=3000 waf_level=high \
--reason "API on Next.js, strict WAF"hosts in a PATCH …/edge is a JSON merge patch (RFC 7396) per name: what you send is added to what the name already has.
curl -sS -X PATCH "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/edge" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "X-Change-Reason: API on Next.js, strict WAF" \
-H "Content-Type: application/json" \
-d '{"hosts": {"api.example.com": {"stack": "nextjs", "origin": {"port": 3000}, "waf_level": "high"}}}'update_settings with host: {"zone": "example.com", "host": "api.example.com", "settings": {"waf_level": "high"}, "reason": "…"}. The settings you give become the name's own; the rest keeps following the zone. ai_agents_settings also accepts host.
Inherit again
Click Inherit again next to a customized value.
openwaf-cloud ctl zones set example.com --host api.example.com --unset waf_level --reason "Back to the zone's level"Send null for the key; nested keys work too.
{"hosts": {"api.example.com": {"waf_level": null, "access_gate": {"enabled": null}}}}{"hosts": {"api.example.com": null}} removes every setting of the name; "hosts": null removes the settings of every name.
Rules for some names
Edge rules (IP, country, WAF exceptions, rate limit rules) and rate limiting rules take a hosts list: with it, the rule applies only to those names; without it (or empty), to every name of the zone.
openwaf-cloud ctl rules add example.com kind=ip ip=198.51.100.10 action=allow hosts:='["admin.example.com"]' --reason "Office"To see the result for one name, open its effective configuration.