---
title: cf.waf.score.xss · Cloudflare Ruleset Engine docs
description: An attack score from 1–99 classifying the cross-site scripting
  (XSS) attack vector.
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.score.xss/
  md: https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.score.xss/index.md
---

# cf.waf.score.xss

`cf.waf.score.xss` Number

An attack score from 1–99 classifying the cross-site scripting (XSS) attack vector.

Requires a Cloudflare Enterprise plan. You must also enable [attack score detection](https://developers.cloudflare.com/waf/detections/attack-score/).

Categories:

* Request
