This page allows you to enable and configure your web application firewall (WAF). Your WAF is required to protect yourself from common web attacks – such as SQL injection, cross-site scripting, and remote file inclusion.
You can use the following options to customize your WAF settings:
- Firewall Mode: You can choose to enable or disable your WAF. If you enable it, your web application will be protected against various web threats. If you disable it, your web application will not use any WAF protection.
- Paranoia Level: You can choose the desired level of rule check to protect your web application. The paranoia level ranges from 1 to 4, where higher levels will apply more rules and strengthen web security, but will also increase the possibility of blocking legitimate traffic and generating false alarms. The recommended level for most use cases is either 1 or 2.
- Anomaly Threshold: The anomaly threshold ranges from 5 to 100, where lower thresholds will block more requests, and higher thresholds will block fewer requests. The recommended level for production sites is 5-10.
- Common Rule Exclusion: You can choose to exclude some rules that may cause false positive for certain web applications. If you are using any of the listed applications – i.e. Drupal, WordPress, Nextcloud, DocuWiki, XenForo, and Magento, you can tick the checkbox to reduce false positives.
- Rules Modification: You can click this button to add or edit your own firewall rules. Firewall rules are used to control incoming traffic to your zone by filtering requests based on location, IP address, user agent, URI, and more. For example, you can create a rule that blocks requests from a specific country or IP address.
For more information, read our blog post on How To Use ModSecurity and OWASP CRS For Web App Firewall (WAF) To Secure Your Website.