What is the Any Paths rule?

Short answer

Any Paths is the base rule that comes ready in every host group and cannot be removed from the list permanently. A request that matches no page type is inspected with this rule; when an exact or glob rule matches, the Check Fields sections and arguments that the rule does not define are completed from Any paths, while the path settings are not inherited (runtime rule matching). In its default configuration, Allowed Methods is GET, OPTIONS, HEAD, POST, PUT, PATCH and DELETE; Path Length is 1–8192; Path Depth is at most 256; OWASP is on; common inspections for Query, Header, JSON, Xml, Form and Raw and the default header rules come with it. The Path field is locked, and the other fields are changed with Edit; it cannot take part in a Merge, and Delete resets the rule to its default configuration.

How Does It Work?

Situation	The role of Any paths
No page type matched	The request is inspected only with Any paths (How is a request that matches no page type inspected?)
One or more glob rules matched	It is combined with the matching glob rules; the section and argument settings that the glob rules do not define are taken from Any paths, and the path settings come from the first matching glob rule (If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?)
An exact rule matched	The Check fields sections and arguments that the exact rule does not define are completed from the glob rules that match the path, and if they are not there either, from Any paths; the path settings come from the exact rule

In the list, the Any paths row appears at the very bottom with the italic Any Paths label; the N page types number on the mode card also includes this rule.

Default Values

Field	Value
Allowed methods	Multiple Methods: GET, OPTIONS, HEAD, POST, PUT, PATCH, DELETE
Path length	Range 1–8192
Path depth	Less Than or Equal To 256
OWASP	On
Check fields	Common inspections for Query, Header, JSON, Xml, Form and Raw (OWASP check on in all of them); default header rules (What are the default header rules?)

• Header-scoped learnings are written to Any paths, not per page; the only exception is an Analysis & Learning applied with Combine With Old Rules (Why are rules learned from headers written to the Any Paths rule rather than per page?).
• If the last Analysis & Learning result was applied with Create new rules, Any paths may have been set up again with a restrictive start (the method list and the body blocks) according to the selected Rule Creating Mode value; in this case, the values differ from the table above (How is a request that matches no page type inspected?).
• The Path length and Path depth inspections are not applied and are not shown in the form if the Structure Checks switch is off; Allowed methods is independent of this switch.
• The delete option of the common inspections is not present in Any paths; their values can be edited.
• Deleting: Can I delete the Any Paths rule? · Merging: Why can't the Any Paths rule be merged with other rules?

Common Misconceptions

• "When Any paths is deleted, WAF is left without inspection." Deleting is resetting; the rule is set up again with its default configuration in the same operation.
• "An exact rule inherits the method and length limits of Any paths." Only the Check fields sections and arguments are inherited; Allowed methods, Path length, Path depth and the path OWASP setting come from the matching rule itself.
• "Tightening done in Any paths affects all paths." It affects only the paths that do not have their own rule and the Check fields sections that the rules do not define.

How it is done in the documentation

• WAF Rules · Page Types Listing Screen
• Edit · Editing the Any Paths Rule
• Delete · The Deletion Steps
• WAF Rules · Runtime: Rule Matching

Related questions

• Can I delete the Any Paths rule?
• How is a request that matches no page type inspected?
• How do inheritance and "Rule Source" work in rules?