Docs

Web Application Firewall

Introduction to protection strategies

Protection policy types

The Web Application Firewall provides preconfigured rule sets, such as vulnerability protection and bot management strategies, offering protection and management capabilities against common web attacks and bots. You can also create custom rules to meet specific requirements, such as custom access allowlist or blocklist rules to permit or restrict access requests from specific IP addresses. Custom rules include information such as rule names and matching conditions. Based on matching conditions, custom rules can allow, block, or log request traffic.

Access control

Access control strategies support setting rules to block or allow access based on IP addresses.

Blocklist: Add specific IP addresses to the network access blocklist, and all related access activities from these IPs will be directly intercepted.

Allowlist: Add specific IP addresses to the network access allowlist, and all related access activities from these IPs will not be affected by any detection or interception rules.

For more information about configuring access control strategies, see Configure access control strategies.

Geographic access control

Geographic access control strategies set network access control rules by country or region based on the origin IP's location.

Domestic: Classified by provincial administrative regions

International: Classified by country or region

For more information about configuring access control strategies, see Configure geographic access control strategies.

Custom interception response

Custom interception response strategies are used to respond to clients whose requests are intercepted by the Web Application Firewall (excluding rate limiting interception), displaying preconfigured response codes and page information.

For more information about configuring access control strategies, see Configure custom interception response.

Rate limiting

The web application firewall supports configuring custom CC protection rules. CC protection policies set request restrictions based on various HTTP request objects, such as network access IP and session, to mitigate the impact of CC attacks on the server.

For more information about configuring CC protection policies, see Configure CC protection policies.

Vulnerability protection

The WAF provides a rule set for vulnerability protection management to defend against common web application attacks, such as SQL injection, cross-site scripting attacks, and webshells. You can select different protection levels to meet protection requirements for different scenarios. The stricter the protection level, the more complex the detection rules. You can also add an allowlist to exclude requests or fields with specific attributes from vulnerability protection policies, meaning the vulnerability detection engine will not inspect content that matches the allowlist rules.

For more information about configuring vulnerability protection policies, see Configure vulnerability protection policies.

API protection

API protection policies inspect API request traffic based on the configured API format and parameters, and perform interception or observation actions on API requests that match specific characteristics. You can manually add API rules or upload JSON format files. You can set unified inspection rules for API access requests without configured rules.

For more information about configuring API protection policies, see Configure API protection policies.

Bot management

By enabling or disabling bots, you can block unnecessary requests or malicious actions from specific bots and ensure that legitimate request traffic is forwarded normally. You can use managed bot rules or custom bot rules, and set bot characteristics as needed.

For more information about configuring bot management, see Configure bot management policies.

Sensitive information leakage prevention

The sensitive information leakage prevention policy can filter user sensitive information, such as ID card numbers, mobile phone numbers, and bank card information, from the content returned by the server. It can display masked sensitive information or return a default error page to prevent the leakage of sensitive user information.

For more information about configuring the sensitive information leakage prevention policy, see Configure the sensitive information leakage prevention policy.

Web tamper protection

The web tamper protection policy means that after configuring the request paths of websites that require protection, the WAF will pre-cache the corresponding page information. When a request is received for a protected website, the cached page is returned to ensure the security of website content and protect against tampering by hackers.

For more information about configuring the web tamper protection policy, see Configure the web tamper protection policy.

Last updated: 2025.12.05 18:52:54