Docs

Web Application Firewall

Configure protection policy

Configure web tamper protection policies

The web tamper protection strategy supports caching the pages of the website that needs to be protected. When a request is received for the protected website, a cached page is returned to ensure the security of the website's content against the risk of hackers tampering.

Prerequisites

You have connected the website that needs to be protected to the WAF instance. For access-related operations, please refer to Comparison of website association methods.

Procedure

Select the instance region in the top menu bar.

In the left navigation, select Protection Policies > Web Tamper Protection.

Enable the web tamper protection feature for the domain name to be protected.

Select the domain name to which you want to add a policy.

(Optional) Confirm that the protection mode of the current domain is "Protection enabled". Otherwise, click Change protection mode to modify it.

Turn on the policy enable switch.

Click Add to configure the web tamper protection rule parameters.

Parameter	Description	Example
Rule name	Protection rule name. tip Start with a letter or digit. Allowed characters include letters, digits, periods (.), underscores (_), and hyphens (-). The length must be between 1 and 128 characters.	tamper_protection_1
Rule description	Fill in the relevant notes for the rule.	Prevent key page information from being tampered with
Request path	Fill in the exact path to be protected, for example: /test.html. tip Please fill in the request path starting with/the precise path that ends with html, shtml, txt, js, css, jpg, png, and does not support wildcards (like /test/*) or parameters, and the page size must not exceed 32 KB.	/test.html
Regular switch off	Turn on or off the current rule.	Keep it enabled

Click OK to complete the rule configuration.

Optional actions

After configuration is complete, you can view rule information in the web tamper protection rule list and perform rule disabling/enabling, cache updating, editing, and deletion operations. <br/>Updating the cache refers to updating the cached page to the current latest page, applicable in scenarios where website content has been updated.

warning

If the protected page with configured rules has updated content, you need to update the cache under the corresponding protection rule; otherwise, the WAF will return the most recent cached record.

Last updated: 2025.06.30 16:22:21