Use WAF in the WAF console - Web Application Firewall - Alibaba Cloud Documentation Center

You can add domain names or instances to Web Application Firewall (WAF), configure protection policies, and view protection data in the WAF console.

The following table lists the references.

Operation	WAF 3.0	WAF 2.0
Activate WAF	Purchase a subscription WAF 3.0 instance Purchase a pay-as-you-go WAF 3.0 instance	WAF 2.0 instances are no longer available for purchase.
Access WAF	Cloud native mode Enable WAF protection for an ALB instance Enable WAF protection for an MSE instance Enable WAF protection for a custom domain name bound to a web application in Function Compute Enable WAF protection for a Layer 7 CLB instance Enable WAF protection for a Layer 4 CLB instance Enable WAF protection for an ECS instance CNAME record mode Add a domain name to WAF Change the DNS record of a domain name	Transparent proxy mode CNAME record mode Add a domain name to WAF Change a DNS record
Configure protection policies	Configure protected objects and protected object groups Configure protection rules Configure protection rules and rule groups for the core protection rule module Configure protection rules for the whitelist module to allow specific requests Configure protection rules for the IP address blacklist module to block specific requests Configure custom rules to defend against specific requests Configure protection rules for the scan protection module Configure protection rules for the custom response module to configure custom block pages Configure HTTP flood protection rules to defend against HTTP flood attacks Configure protection rules for the region blacklist module to block requests from specific regions Configure protection rules for the website tamper-proofing module to prevent web page tampering Configure protection rules for the data leakage prevention module to prevent data leaks Major event protection Enable and configure the bot management module	Configure the protection rules engine feature Whitelist Configure a website whitelist Configure a whitelist for web intrusion prevention Configure a whitelist for Data Security Configure a whitelist for Bot Management Configure a whitelist for Access Control/Throttling Configure a blacklist Configure a custom protection policy Configure scan protection Configure HTTP flood protection Configure the website tamper-proofing feature Configure data leakage prevention Configure the positive security model Configure account security Bot management
Configure monitoring and alerting	Configure CloudMonitor notifications Use Simple Log Service to configure monitoring and alerting for WAF	Configure CloudMonitor notifications Create alert rules for different types of events by using the alerting feature provided by Log Service for WAF
View protection data	Security reports Query logs	View security reports Get started with the Simple Log Service for WAF feature