# Per-name settings

> Give one name of a zone its own WAF, origin, access gate, rate limits or AI Crawl Control settings while it inherits everything else from the zone.

A zone holds every name of a registrable domain: `example.com`, `www.example.com`, `api.example.com`, `shop.example.com`… Each proxied name is a site at the edge. By default every name uses the zone's edge settings. A name can override some of them in `hosts.<name>`: its site is then the zone's settings with its own values on top.

- Nested objects (`access_gate`, `hsts`, `origin`, `cache`, `rum`) merge field by field: a name can change only `origin.port`.
- Lists (`cors_allow_origins`, `redirect_allow_hosts`, `access_gate.emails`…) are replaced whole.
- `rate_rules`, `early_hints` and `ai_agents` of a name replace the zone's **as a whole**. The first time you change a name's `ai_agents` or `early_hints`, the fields you don't give are copied from the zone.

Up to 100 names per zone can have their own settings. A name must be the zone or below it. You can prepare settings for a name before it has a proxied record; the change then warns that the edge doesn't serve the name yet.

## Keys a name can override

| Key | Notes |
|---|---|
| `mode`, `waf_level`, `stack`, `enable_feed`, `rate_limit_rpm` | [WAF settings](https://developers.openwaf.dev/waf/settings/) |
| `block_page_mode`, `block_page_html`, `fake_server_header` | [Block page](https://developers.openwaf.dev/waf/block-page/) |
| `max_body_mb`, `timeout_ms`, `compression` | [WAF settings](https://developers.openwaf.dev/waf/settings/) |
| `redirect_allow_hosts`, `cors_allow_origins` | Lists, replaced whole. |
| `access_gate` | `enabled`, `path`, `ttl_hours`, `emails`. |
| `hsts` | `max_age`, `include_subdomains`, `preload`; see [HSTS](https://developers.openwaf.dev/ssl/hsts/). |
| `origin` | `scheme`, `port`, `tls_verify`, `server_name`, `client_cert`; see [Origin TLS](https://developers.openwaf.dev/ssl/origin-tls/). |
| `cache`, `early_hints` | See [Cache](https://developers.openwaf.dev/cache/). |
| `rum` | See [Analytics](https://developers.openwaf.dev/analytics/). |
| `rate_rules` | The name's own list; its rules don't carry `hosts`. `[]` = no rules for this name. See [Rate limiting](https://developers.openwaf.dev/waf/rate-limiting/#per-name-lists). |
| `ai_agents` | See [AI Crawl Control settings](https://developers.openwaf.dev/ai-crawl-control/settings/). |

`redirects` and `hosts` can't be set inside a name: every redirect rule already names its `host`. An unknown key is rejected with `422`.

## Override a setting

**Dashboard**

On **Security → Firewall**, **Security → Access gate** and the other settings pages that show **Applies to**, pick a name instead of **Whole domain (every name)**. Greyed values are inherited; **Customize for this name** gives the name its own value. **Names** lists every proxied name with the number of settings it customizes; **Settings** opens them.
**CLI**

```sh
openwaf-cloud ctl zones set example.com --host api.example.com stack=nextjs origin.port:=3000 waf_level=high \
  --reason "API on Next.js, strict WAF"
```
**API**

`hosts` in a `PATCH …/edge` is a JSON merge patch (RFC 7396) per name: what you send is added to what the name already has.
```sh
curl -sS -X PATCH "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/edge" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "X-Change-Reason: API on Next.js, strict WAF" \
  -H "Content-Type: application/json" \
  -d '{"hosts": {"api.example.com": {"stack": "nextjs", "origin": {"port": 3000}, "waf_level": "high"}}}'
```
**MCP**

`update_settings` with `host`: `{"zone": "example.com", "host": "api.example.com", "settings": {"waf_level": "high"}, "reason": "…"}`. The settings you give become the name's own; the rest keeps following the zone. `ai_agents_settings` also accepts `host`.


## Inherit again

**Dashboard**

Click **Inherit again** next to a customized value.
**CLI**

```sh
openwaf-cloud ctl zones set example.com --host api.example.com --unset waf_level --reason "Back to the zone's level"
```
**API**

Send `null` for the key; nested keys work too.
```json
{"hosts": {"api.example.com": {"waf_level": null, "access_gate": {"enabled": null}}}}
```
`{"hosts": {"api.example.com": null}}` removes every setting of the name; `"hosts": null` removes the settings of every name.


## Rules for some names

Edge rules (IP, country, WAF exceptions, rate limit rules) and rate limiting rules take a `hosts` list: with it, the rule applies only to those names; without it (or empty), to every name of the zone.

```sh
openwaf-cloud ctl rules add example.com kind=ip ip=198.51.100.10 action=allow hosts:='["admin.example.com"]' --reason "Office"
```

To see the result for one name, open its [effective configuration](https://developers.openwaf.dev/rules/effective-config/).