Protection configuration overview

Step

Cloud native mode

CNAME record mode

1. Add a protected object.

The cloud service instances that are added to WAF in cloud native mode are automatically added as protected objects in WAF.

If you want to configure different protection rules for different domain names that point to the same cloud service instance, you must manually add the domain names as protected objects in WAF. For more information, see Configure protected objects and protected object groups.

The domain names that are added to WAF in CNAME record mode are automatically added as protected objects in WAF.

2. (Optional) Add the protected object to a protected object group.

If you want to configure the same protection rule for multiple protected objects, you can add the protected objects to a protected object group and then configure the protection rule for the protected object group. The protection rule takes effect on all protected objects in the group.

Before you can use a protected object group, you must create a protected object group and add protected objects to the group. For more information, see Create a protected object group.

3. Create a protection template.

Before you can enable a protection module, you must create a protection template for the protection module. Then, you can apply the protection template to specific protected objects or protected object groups.

The core protection rule and whitelist modules provide default protection templates. You do not need to create protection templates to enable these modules. If you want to enable other protection modules, you must create protection templates for the protection modules. For more information, see Protection module overview.

You can create multiple protection templates that contain different protection rules and apply different protection rules to specific protected objects. For more information, see Example: Configure multiple protection templates for a protection module.

4. Manage protection rules.

You can manage protection rules in the protection templates of different protection modules. For example, you can create, enable, or disable protection rules. Modifications to protection rules in a protection template take effect on all protected objects to which the protection template is applied.

The operations that you can perform on protection rules vary based on the protection template. For more information, see Protection module overview.

Protection module

Description

Default protection template

Configuration suggestion

Core protection rule

Defends against common web application attacks based on a built-in protection rule set. The common web application attacks include SQL injection, cross-site scripting (XSS), code execution, webshell upload, and command injection.

A default protection template is provided, and the template uses the protection rule set provided by WAF. By default, the protection template is enabled, and the Block action is specified.

We recommend that you retain the default configuration.

If specific protection rules in the protection rule set block normal requests, you can configure a protection rule for the whitelist module based on the specified protection rules to prevent false positives. For more information, see Configure protection rules for the whitelist module to allow specific requests.

Rule group

Defends against attacks based on a group of protection rules. You can configure a custom rule group or use the default rule group. You can associate a rule group with a protection template of the core protection rule module to protect your website from common web application attacks.

A default rule group is provided.

To enable a custom rule group, you must create a protection template and configure protection rules for the template.

Whitelist

Allows requests that have specific characteristics to bypass the checks of all or specified protection modules. You can configure the characteristics of the requests based on your business requirements.

A default protection template is provided, but no protection rules are pre-defined in the default protection template. By default, the protection template is enabled.

If you want WAF to allow requests that have specific characteristics, you can create protection rules in the default protection template of the whitelist module.

HTTP flood protection

Mitigates HTTP flood attacks based on built-in common HTTP flood protection algorithms. You can also configure throttling for HTTP flood protection in the custom rule module.

A default protection template is provided, but no protection rules are pre-defined in the default protection template. By default, the protection template is enabled.

To enable a custom protection rule, you must create a protection template and configure the protection rule in the template.

Scan protection

Identifies the scanning behaviors and characteristics of scanners to prevent attackers or scanners from scanning your websites. This helps reduce the risk of intrusions into web services and blocks unwanted scanning traffic.

A default protection template is provided, but no protection rules are pre-defined in the default protection template. By default, the protection template is enabled.

To enable a custom protection rule, you must create a protection template and configure the protection rule in the template.

IP address blacklist

Blocks requests from specified IPv4 addresses, IPv6 addresses, or CIDR blocks. You can specify the IP addresses or CIDR blocks based on your business requirements.

No default protection template is provided. By default, this protection module is disabled.

To enable this protection module, you must create a protection template and configure protection rules for the template.

Custom rule

Blocks requests, verifies requests, or records logs based on the characteristics of HTTP requests or a set of custom characteristics that you specify.

When you configure a protection rule, you can turn on Rate Limiting. If a statistical object, such as an IP address or a session, matches the specified condition, the statistical object is added to the blacklist. During the specified period of time, WAF performs the specified action on all requests from the statistical object.

Custom response

Allows you to configure custom block pages that WAF returns to clients when the requests of the clients are blocked by WAF. You can specify a custom status code, response header, and response body.

Region blacklist

Allows you to block client IP addresses from specific regions with a few clicks.

Website tamper-proofing

Locks specific web pages to prevent content tampering. When a locked web page receives a request, a pre-defined cached page is returned.

Data leakage prevention

Filters abnormal returned content and masks sensitive information, such as ID card numbers, phone numbers, bank card numbers, and sensitive words.

Bot management for basic protection

Identifies Layer 4 and Layer 7 bot traffic by using fingerprinting techniques.

Bot management for website protection

Identifies bot traffic based on the characteristics of clients, traffic, behaviors, and intelligence, and blocks malicious traffic to prevent unwanted bandwidth consumption, data crawling, spam user registration, malicious orders, malicious voting, and abuse of APIs.

Bot management for app protection

Major event protection

Ensures the security of major events within a specific time range and provides precise protection for your services.

No default protection template is provided. By default, this protection module is disabled.

To enable this protection module, you must create a protection template and configure protection rules for the template.

API security

Sorts the API assets of services that are protected by WAF and detects API risks, such as unauthorized access to APIs, exposure of sensitive data, and exposure of internal APIs. This protection module provides reports on API exception events, suggestions for handling detected risks, and references for API lifecycle management.

N/A.

Traffic spike throttling

Allows you to limit the number of requests to specific servers by specifying a QPS or percentage limit and filters for traffic from selected regions.

No default protection template is provided. By default, this protection module is disabled.

To enable this protection module, you must create a protection template and configure protection rules for the template.