Help Center/ Web Application Firewall/ Help Panel/ Tier-2 Help Panel - Dashboard/ Configuring Protection Policies
Updated on 2025-04-25 GMT+08:00
Share

Configuring Protection Policies

WAF built-in protection rules and protection rules you customize works differently.

How WAF built-in protection rules work

WAF built-in protection rules include basic web protection rules and feature-based anti-crawler rules.

Figure 1 WAF engine work process
  • Pass: The current request is unconditionally permitted after a protection rule is matched.
  • Block: The current request is blocked after a rule is matched.
  • CAPTCHA: The system will perform human-machine verification after a rule is matched.
  • Redirect: The system will notify you to redirect the request after a rule is matched.
  • Log: Only attack information is recorded after a rule is matched.
  • Mask: The system will anonymize sensitive information after a rule is matched.

How custom protection rules work

Figure 2 Priorities of protection rules

WAF has built-in basic web protection rules and feature-based anti-crawler rules. If you toggle on () a protection type, WAF will enable the corresponding rules.

Basic web protection rules

WAF basic web protection defends against common web attacks, such as SQL injection, XSS attacks, remote buffer overflow attacks, file inclusion, Bash vulnerability exploits, remote command execution, directory traversal, sensitive file access, and command and code injections. Basic web protection also detects web shells and evasion attacks.

Figure 3 Rule Configuration

Feature-based anti-crawler protection rule

Feature-based anti-crawler identifies and blocks crawler behavior from search engines, scanners, script tools, and other crawlers.

Figure 4 Feature Library

Related Operations

You can customize protection rules to meet your website protection requirements.

Protection rules

Description

CC Attack Protection

You can customize a CC attack protection rule to restrict access to a specific URL on your website based on an IP address, cookie, or Referer, mitigating CC attacks. Protective actions of CC attack protection rules include Verification code, Block, Dynamically block, and Log only.

Precise Protection

You can combine HTTP headers, cookies, access URLs, request parameters, or client IP addresses to customize precise protection rules. This type of rules can be used to prevent hotlinking and protect website management background.

IP Address Blacklist and Whitelist

You can configure IP address blacklist and whitelist rules to block or allow access requests from specified IP addresses.

Known Attack Source

If WAF blocks a malicious request by IP address, Cookie, or Params, you can configure a known attack source rule to let WAF automatically block all requests from the attack source for a blocking duration set in the known attack source rule.

NOTICE:

Only basic web protection, precise access protection, blacklist, and whitelist rules can use known attack source rules.

For example, if a blocked malicious request originates from IP address 192.168.1.1 and you set the blocking duration to 500 seconds, WAF will block the source IP address for 500 seconds after the known attack source rule takes effect.

Geolocation Access Control

This type of rule can block or protect source IP addresses in specified countries and regions.

Web Tamper Protection

This type of rule protects only static pages. If an attacker modifies a static web page on the server, WAF still returns the cached original web page to visitors. Visitors never see the pages that were tampered with.

JavaScript Anti-Crawler

You can customize JavaScript anti-crawler protection rules.

Information Leakage Prevention
  • Sensitive information filtering

    Prevents disclosure of sensitive information (such as ID numbers, phone numbers, and email addresses).

  • Response code interception

    Blocks the specified HTTP status codes.

Global Protection Whitelist

You can configure this type of rule to mask events falsely reported based on the built-in rules (basic web protection rules and feature-based anti-crawler rules). In doing this, WAF will no longer block similar requests and display corresponding events on the Events page, and you will not receive alarm notifications accordingly.

Data Masking

PWAF masks sensitive information, such as usernames and passwords, in the event log.
Parent Topic: Tier-2 Help Panel - Dashboard