DocsSecurityWeb Application Firewall

Web Application Firewall

Protect HTTP applications from injection, cross-site scripting, bots, and abuse.

The WAF inspects HTTP/HTTPS requests before they reach your web applications, blocking exploitation attempts that network firewalls cannot see — SQL injection, cross-site scripting, path traversal, malicious file uploads, scanner traffic, and brute-force patterns.

Deployment

The WAF sits in front of a load balancer or directly in front of a web VM. Point it at the backend, then direct your public traffic (elastic IP or DNS) at the WAF endpoint. SSL can terminate at the WAF so encrypted traffic is inspected.

Protection Layers

Layer	What it stops
Core rule set	SQL injection, XSS, command injection, path traversal, and other common web attack classes
Protocol validation	Malformed requests, oversized headers/bodies, HTTP smuggling patterns
Bot & scanner control	Known scanner signatures, credential-stuffing and content-scraping behavior
Rate limiting	Per-IP request ceilings on sensitive paths such as /login and /api
Custom rules	Your own match conditions on path, method, headers, geo, or IP ranges

Recommended Rollout

Start in detection mode

The WAF logs what it would block without blocking. Run production traffic through it for several days.

Review and tune

Check flagged requests in the WAF log. Add exceptions for legitimate application behavior that trips generic rules (this is normal for complex apps).

Switch to prevention

Enable blocking. Keep an eye on the log for the first week; from then on the WAF works silently.

Custom Rule Example

yaml

# Rate-limit login attempts: max 20 requests / 5 min per source IP
rule:
  name: login-rate-limit
  match:
    path: /login
    method: POST
  action: rate_limit
  limit: 20
  window_seconds: 300
  block_duration_seconds: 900

WAF events feed into the platform SOC monitoring — sustained attack patterns raise alerts rather than sitting unnoticed in a log file.

Build on DAAKYI Cloud