# WAF settings reference

> Every WAF-related edge setting of a zone or name: values, defaults and how the edge uses them.

These fields are part of a zone's edge settings (`GET/PATCH /v1/orgs/{org}/zones/{zone}/edge`). A `PATCH` changes only the fields you send; nested objects merge field by field and lists are replaced whole. Every field except `redirects` can also be set for one name under `hosts.<name>` (see [Per-name settings](https://developers.openwaf.dev/rules/per-name-settings/)).

| Field | Type | Default | Meaning |
|---|---|---|---|
| `mode` | `active`, `log`, `off` | `active` | [WAF mode](https://developers.openwaf.dev/waf/modes-and-levels/#modes). |
| `waf_level` | `off`, `low`, `medium`, `high` | `medium` | [WAF level](https://developers.openwaf.dev/waf/modes-and-levels/#levels). |
| `stack` | `generic`, `wordpress`, `nextjs`, `static` | `generic` | [Application](https://developers.openwaf.dev/waf/modes-and-levels/#application). |
| `enable_feed` | boolean | `true` | Block addresses of the [threat feeds](https://developers.openwaf.dev/waf/threat-feeds/). |
| `rate_limit_rpm` | integer ≥ 0 | `0` | [Basic rate limit](https://developers.openwaf.dev/waf/rate-limiting/#basic-rate-limit) per IP and minute; `0` = off. |
| `rate_rules` | list, at most 25 | `[]` | [Rate limiting rules](https://developers.openwaf.dev/waf/rate-limiting/#per-path-rules); see [fields](https://developers.openwaf.dev/waf/rule-reference/#rate-limiting-rule-fields). |
| `access_gate` | object | off | [Access gate](https://developers.openwaf.dev/waf/access-gate/#settings): `enabled`, `path`, `ttl_hours`, `emails`. |
| `block_page_mode` | `branded`, `nginx`, `apache`, `generic`, `custom` | `branded` | [Block page](https://developers.openwaf.dev/waf/block-page/). |
| `block_page_html` | string, at most 256 KiB | `""` | HTML of the `custom` block page. |
| `fake_server_header` | string | `""` | Value of the `Server` header; empty = `nginx`. |
| `max_body_mb` | integer ≥ 0 | `0` | Largest request body in MB; larger requests get 413. `0` = the edge default. |
| `timeout_ms` | integer ≥ 0 | `0` | How long the edge waits for the origin, in milliseconds. `0` = the edge default. |
| `redirect_allow_hosts` | list of hosts | `[]` | Extra hosts the [open redirect shield](https://developers.openwaf.dev/waf/shields/#open-redirect) accepts. |
| `cors_allow_origins` | list of hosts | `[]` | Sister domains whose reflected CORS origins are kept (see [CORS](https://developers.openwaf.dev/waf/responses/#cors)). |
| `compression` | boolean | `false` | Compress text responses that the origin sends uncompressed (gzip, Brotli). |

## redirect_allow_hosts

Each entry is a lower-case host name (`partner.example.net`), `localhost`, an IPv4 address or a bracketed IPv6 address (`[2001:db8::1]`). A host name matches itself and its subdomains; an address matches only itself. Wildcards are not accepted.

## cors_allow_origins

Each entry is a lower-case host name, without scheme or port (`app.example.net`). It matches itself and its subdomains. Duplicates are rejected.

## Other edge settings

| Field | Documented in |
|---|---|
| `origin`, `hsts` | [SSL/TLS](https://developers.openwaf.dev/ssl/) |
| `redirects` | [Redirect rules](https://developers.openwaf.dev/rules/redirects/) |
| `hosts` | [Per-name settings](https://developers.openwaf.dev/rules/per-name-settings/) |
| `ai_agents` | [AI Crawl Control settings](https://developers.openwaf.dev/ai-crawl-control/settings/) |
| `cache`, `early_hints` | [Cache](https://developers.openwaf.dev/cache/) |
| `rum` | [Analytics](https://developers.openwaf.dev/analytics/) |

## Validation

An invalid value is rejected with `422` and a message that names the field, for example `rate_rules[0].path_prefix: …` or `hosts.www.example.com.rate_rules[1].hosts: …`. Nothing is applied.