The Web Application Firewall (WAF) inspects every incoming request at the edge node and blocks common web attacks by rule. Once enabled, no changes to your application are needed — malicious traffic is stopped before it reaches your origin.
What WAF protects against
WAF covers a range of common attack categories: SQL injection, XSS, command injection, path traversal, malicious bots and scanners, and more. Each category is a set of rules, and requests matching an attack signature are blocked or challenged.
Turn on WAF
Flip the WAF switch under "Security" on the site detail page to enable the built-in rule set. We recommend new sites enable baseline protection by default — it's nearly invisible to normal visitors yet blocks a large volume of automated attacks.
- The baseline rule set works out of the box, covering the most common attack patterns.
- You can enable or disable specific rule categories to fit your application's profile.
Observe and block modes
Rules can run in two modes: observe mode only logs hits without actually blocking, good for assessing impact right after launch; block mode stops matching requests outright. We recommend running observe mode for a while first, confirming no false hits on normal requests, then switching to block.
Handling false positives
If a normal request gets blocked, find which rule it hit in the security log, then whitelist that path or parameter, or adjust the rule. Converge gradually to keep protection strong without disrupting legitimate traffic.