Configure payload logging in the dashboard

Note

Only users with the Super Administrator role can configure payload logging and decrypt payloads in the Cloudflare dashboard. Other users can decrypt payloads if they have access to the logs and to the private key.

Old dashboard

1. Log in to the Cloudflare dashboard ↗, and select your account and domain.

2. Go to Security > WAF > Managed rules tab.

   

3. To configure payload logging for a ruleset you had already deployed in the WAF, select the managed ruleset name.

4. At the bottom of the page, select Configure payload logging.

5. After reading and understanding the implications of enabling payload logging, select one of the available options:

   • Generate key pair using your web browser: Generates a key pair (a private and a public key) in your browser and configures payload logging with the generated public key.

   • Use my own public key: Enter a public key generated by the matched-data-cli command-line tool.

6. Select Next.

7. If you generated a key pair in the browser, copy the displayed private key and store it safely. You will use this private key later to view the decrypted payload content.

8. Select Done.

9. If you are deploying the managed ruleset where you configured payload logging, select Deploy. If you configured payload logging for a ruleset you had already deployed, select Save.

New dashboard

1. In the Cloudflare dashboard, go to the Security rules page.

   Go to Security rules

2. (Optional) Filter by Managed rules.

3. Search for the managed ruleset you want to configure. Look for a rule with an Execute action.

4. Select the rule name (containing the name of the managed ruleset).

5. At the bottom of the page, select Configure payload logging.

6. After reading and understanding the implications of enabling payload logging, select one of the available options:

   • Generate key pair using your web browser: Generates a key pair (a private and a public key) in your browser and configures payload logging with the generated public key.

   • Use my own public key: Enter a public key generated by the matched-data-cli command-line tool.

7. Select Next.

8. If you generated a key pair in the browser, copy the displayed private key and store it safely. You will use this private key later to view the decrypted payload content.

9. Select Done, and then select Save.