Docs

Web Application Firewall

Product overview

Features

BytePlus Web Application Firewall (hereinafter referred to as WAF) provides functions such as data dashboard, instance management, website access, policy configuration, IP blocking, and log retrieval. This article provides a simple explanation to help you understand the functions supported by the product initially.

Security Panorama and Overview

Function	Description
Security Panorama and Overview	Display the number of protected websites, number of attacks prevented, number of intercepted IPs, and request peak information, helping you quickly understand business data status.
Business overview	Display detailed business information of the websites that users have accessed. You can refer to different illustrations to understand the operational status of the website within the selected time period.
Attack Overview	This displays the attack statistics of the websites that users have accessed and shows the attack situation faced by the protected website. Supports viewing attack protection data under different protection strategies.

System Management

Function	Description
Instance management	Create WAF instances that meet requirements to protect corresponding website services. Modify instance names and protection modes, as well as upgrade and renew instances.
Certificate management	Host certificates through BytePlus Certificate Center, and view the corresponding details in the WAF console.
IP address group management	Batch create IP addresses or address ranges to associate with the corresponding access allowlist or blocklist, improving the configuration and maintenance efficiency of access control policies.

Website Settings

Function	Description
Create a new site	Access the protected website through CNAME, application load balancing, or load balancing methods, and configure access capability and origin capability to route business traffic to the WAF instance for protection.
Manage website	View information about all websites that have integrated WAF protection, including domain names, source server IPs, protection status, and attack monitoring information. You can also edit website settings and protection rules, or解除 the website's protection relationship with WAF.

Protection Strategy

Function	Description
Access Control	Access control policies support access control rules based on IP address and location. You can allow or block requests from specific IP addresses or IP segments, or restrict access to your web applications by country or region. You can also customize the blocking response page to respond to requests blocked by the web application firewall client side, displaying pre-configured response codes and page information.
Rate limiting	CC attack (Challenge Collapsar attack) is a seven-layer DDoS attack targeting web application servers, using a large volume of seemingly legitimate web requests to occupy system resources. The rate limiting policy can set request limiting conditions based on various HTTP request objects such as network access IP and Session to mitigate the impact of CC attacks on the server.
Vulnerability Protection	The WAF provides a rule set for vulnerability protection management to defend against common web application attacks, such as SQL injection, cross-site scripting attacks, and website Trojans. You can choose different protection levels to adapt to the attack protection needs of different scenarios. The stricter the protection level, the more complex the detection rules. You can also add an allowlist to exclude requests or fields that meet specific attributes from the vulnerability protection policy, meaning that the vulnerability detection engine will not detect content that meets allowlist rules.
API protection	API protection policies refer to inspecting API request traffic based on the configured API formats and parameters, executing filtering or monitoring actions on API requests that meet specific characteristics. Supports manual addition of API rules or uploading JSON format files. For API access requests without configured rules, it supports unified setting of inspection rules.
Bot management	By enabling or disabling bots, unnecessary requests or malicious behaviors from specific bots can be blocked, ensuring that legitimate request traffic is forwarded normally. You can use hosted bot rules or custom bot rules and set bot characteristics according to your needs.
Sensitive information leakage prevention	The sensitive information leakage prevention policy can filter user sensitive information in the server response content, such as ID card numbers, mobile phone numbers, and bank card information, desensitizing sensitive information display or returning a default error response page to prevent leakage of users' sensitive information.
web tamper protection	Web tamper protection strategy means that after configuring the website request path that needs to be protected, WAF will cache the corresponding page information in advance. When a request is received for a protected website, a cached page is returned to ensure the security of the website's content against the risk of hackers tampering.

Blocking Management

Function	Description
View ban content	View attack source IP information for different domains based on attack type and source IP, including the number of times intercepted, processing status, etc. Support viewing attack logs, and if confirmed as normal requests, can be processed through the allowlist.

Log management

Function	Note
View and analyze logs	Support collecting web attack and access log data for the protection resources added to WAF, and provide search analysis, monitoring alerts, data visualization, etc., based on BytePlus log service. This helps you quickly understand the status of web request business and protection effectiveness to promptly handle anomalies.
Log settings	Set log capacity alarm thresholds and alarm intervals, modify log storage duration, and set the domain range, field range, and disposal action range for log collection to make efficient use of log capacity.
Download logs	Supports downloading original log data or chart analysis results to the local machine for centralized log information viewing and data analysis.

Last updated: 2025.06.30 16:12:52