Web Application Firewall:What is Web Application Firewall

Web application protection

WAF defends against common OWASP attack types:

• SQL injection

• Cross-site scripting (XSS)

• Webshell uploads and backdoor attacks

• Command injection

• Cross-site request forgery (CSRF)

• Path traversals

• Unauthorized access to core files

• Illegal HTTP requests and common web server vulnerabilities

• Website scanning

WAF also patches zero-day vulnerabilities at the earliest opportunity, so your applications stay protected even before official vendor patches are available.

Monitoring mode: Enable monitoring mode to observe traffic on new services without blocking. WAF sends alerts when suspicious traffic matches a protection rule, but does not block it — useful when tuning rules to reduce false positives.

Precise protection

WAF's detection engine parses and decodes request data before inspecting it:

• Format parsing: HTTP headers, form data, multipart, JSON, and XML

• Decoding: URL encoding, JavaScript Unicode, HEX, HTML entity, Java serialization, PHP serialization, Base64, UTF-7, UTF-8, and nested encoding

• Preprocessing: Space compression, comment pruning, and special character normalization

Adaptive decoding prevents attackers from bypassing WAF by encoding payloads in unusual formats.

HTTP flood protection

WAF limits request rates from specific IP addresses using CAPTCHA verification and redirect-based authentication. For slow HTTP attacks, WAF analyzes statistical signals — status code distribution, requested URL patterns, anomalous HTTP Referer headers, and User-Agent characteristics — to distinguish legitimate traffic from attacks.

Alibaba Cloud's big data security platform feeds threat intelligence and trusted-access models into WAF, enabling it to identify malicious requests across hundreds of millions of daily attacks.

Fine-grained access control

Build protection rules based on combinations of HTTP fields: IP address, URL, HTTP Referer, and User-Agent. Use these rules for scenarios such as hotlink protection and website backend access control.

Fine-grained access control layers with web security and HTTP flood protection modules to create a multi-layer architecture that distinguishes trusted from malicious traffic with high precision.

Virtual patching

Adjust WAF protection rules immediately when a new vulnerability is disclosed — before the affected software is patched. This closes the window between disclosure and patch deployment without requiring application changes.

Attack event management

Review attack events, attack traffic volumes, and attack scales through the WAF console. Use this data to tune protection rules and understand your threat landscape.

Reliability and scalability

WAF runs in cluster mode with built-in load balancing and multiple scheduling algorithms. Scale capacity by adding or removing nodes without service interruption. If a WAF node fails or undergoes maintenance, the cluster continues to handle traffic — no single point of failure (SPOF).

CNAME record mode

Works for origin servers on Alibaba Cloud or on-premises. Change your domain's DNS record to point to WAF's CNAME address — WAF then intercepts and inspects all incoming traffic. For setup steps, see Add a domain name to WAF.

Transparent proxy mode

Available for ECS instances and backend servers of Internet-facing SLB instances. Based on cloud-native technologies, transparent proxy mode requires no DNS changes — traffic is automatically routed through WAF. For setup steps, see Transparent proxy mode.