---
title: Get started with malicious uploads detection · Cloudflare Web Application Firewall (WAF) docs
description: Use Security Analytics and HTTP logs to validate that malicious content objects are being detected correctly.
lastUpdated: 2025-04-16T16:28:57.000Z
source_url:
  html: https://zt-dark-mode-changelog.preview.developers.cloudflare.com/waf/detections/malicious-uploads/get-started/index.md
  md: https://zt-dark-mode-changelog.preview.developers.cloudflare.com/waf/detections/malicious-uploads/get-started/
---

Note

WAF content scanning is available to customers on an Enterprise plan with a paid add-on.

## 1. Turn on the detection

* Dashboard

  1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.
  2. Go to **Security** > **Settings**.
  3. Under **Incoming traffic detections**, turn on **Malicious uploads**.

* API

  Use a `POST` request similar to the following:

  ```bash
  curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/content-upload-scan/enable" \
    --request POST \
    --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
  ```

* Terraform

  Use the `cloudflare_content_scanning` resource to enable content scanning for a zone. For example:

  ```terraform
  resource "cloudflare_content_scanning" "zone_content_scanning_example" {
    zone_id = "<ZONE_ID>"
    enabled = true
  }
  ```

## 2. Validate the content scanning behavior

Use [Security Analytics](https://developers.cloudflare.com/waf/analytics/security-analytics/) and HTTP logs to validate that malicious content objects are being detected correctly.

You can use the [EICAR anti-malware test file](https://www.eicar.org/download-anti-malware-testfile/) to test content scanning (select the ZIP format).

Alternatively, create a WAF custom rule like described in the next step using a *Log* action instead of a mitigation action like *Block*. This rule will generate security events (available in **Security** > **Events**) that will allow you to validate your configuration.

## 3. Create a WAF custom rule

Create a WAF [custom rule](https://developers.cloudflare.com/waf/custom-rules/) that blocks detected malicious content objects uploaded to your application.

For example, create a custom rule with the *Block* action and the following expression:

| Field | Operator | Value |
| - | - | - |
| Has malicious content object | equals | True |

If you use the Expression Editor, enter the following expression:

```txt
(cf.waf.content_scan.has_malicious_obj)
```

This rule will match requests where the WAF detects a suspicious or malicious content object. For a list of fields provided by WAF content scanning, refer to [Content scanning fields](https://developers.cloudflare.com/waf/detections/malicious-uploads/#content-scanning-fields).

For additional examples, refer to [Example rules](https://developers.cloudflare.com/waf/detections/malicious-uploads/example-rules/).

## 4. (Optional) Configure a custom scan expression

To check uploaded content in a way that is not covered by the default configuration, add a [custom scan expression](https://developers.cloudflare.com/waf/detections/malicious-uploads/#custom-scan-expressions).

* Dashboard

  1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account and domain.

  2. Go to **Security** > **Settings**.

  3. Under **Incoming traffic detections**, select **Malicious uploads**.

  4. Select **Add content object location**.

  5. In **Content location**, enter your custom scan expression. For example:

     ```txt
     lookup_json_string(http.request.body.raw, "file")
     ```

  6. Select **Save**.

* API

  Use a `POST` request similar to the following:

  ```bash
  curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/content-upload-scan/payloads" \
    --request POST \
    --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    --json '[
      {
          "payload": "lookup_json_string(http.request.body.raw, \"file\")"
      }
    ]'
  ```

  The above request will add the following expression to the current list of custom scan expressions:

  ```txt
  lookup_json_string(http.request.body.raw, "file")
  ```

* Terraform

  Use the `cloudflare_content_scanning_expression` resource to add a custom scan expression. For example:

  ```terraform
  resource "cloudflare_content_scanning_expression" "my_custom_scan_expression" {
    zone_id = <ZONE_ID>
    payload = "lookup_json_string(http.request.body.raw, \"file\")"
  }
  ```

For more information, refer to [Custom scan expressions](https://developers.cloudflare.com/waf/detections/malicious-uploads/#custom-scan-expressions).
