Configure WAF protection policies for different user roles and business needs - Web Application Firewall

This topic guides you through selecting protection modules and configuring policies for Web Application Firewall (WAF) for different scenarios and user roles. This helps you address your most critical requirements first and understand WAF's protection logic.

Prerequisites

You have added your website to WAF. For more information, see Add a domain name.

Before you begin

The instructions in this topic assume that you have enabled the required protection features. If you have not enabled the recommended features, refer to the relevant documentation to enable and configure them.

To go to the Website Protection page, follow these steps:

Log on to the Web Application Firewall (WAF) console. In the top menu bar, select the resource group and region for your WAF instance: Chinese Mainland or Outside Chinese Mainland.
In the left navigation pane, choose Protection Config > Website Protection.
On the Website Protection page, switch to the domain name to configure.

Overview

This topic provides recommendations for website protection based on different user roles and business requirements. Select the scenario that best fits your needs to learn about the recommended protection settings:

I'm new to security and have no special requirements
I'm an O&M engineer who wants stable services and fast troubleshooting
I'm a security professional who needs to perform comprehensive web intrusion operations
My business requires strict security and I prefer false positives over missed detections
My business is frequently targeted by crawlers or is at risk of data leaks and tampering

For new users with basic needs

If you purchased WAF for compliance or to improve your security posture, you can use the default protection settings without adjustment after adding your website. The default protection capabilities of WAF are sufficient to defend your website against most basic web threats.

Monitor the Overview and Security Report pages in the WAF console to stay informed about your service status and detected attacks. For more information, see the following topics:

For O&M: stability and fast troubleshooting

To meet your needs, configure the following protection features after you add your website:

Website Whitelist: Configure a website access whitelist to allow requests that meet specified conditions to bypass all protection checks.

Navigation: On the Website Protection page, click Website Whitelist in the upper-right corner to configure the feature. For more information, see Configure a website whitelist.
You can also configure whitelists for specific protection modules to implement more precise protection. For more information, see the following topics:
- Web intrusion prevention allowlist: Allows requests to bypass the rule protection engine modules.
- Data security allowlist: Allows requests to bypass the sensitive data leakage prevention, website tampering prevention, and account security modules.
- Bot management allowlist: Allows requests to bypass the crawler threat intelligence, data risk control, intelligent algorithm, and app protection modules.
- Access control/rate limiting allowlist: Allows requests to bypass the CC attack protection, IP blocklist, scan protection, and custom rules modules.
IP Address Blacklist: Blocks access requests from IP addresses and address ranges that are unrelated to your services, and from source IPs in specified geographic regions. For example, if a local government forum is not intended for users in other provinces, you can add those provinces to a region-level blacklist. If a website does not have users from Regions outside Chinese mainland, you can add Regions outside Chinese mainland to a region-level blacklist.

Navigation: On the Website Protection page, click the Access Control/Throttling tab, and then navigate to the IP Address Blacklist section to configure the feature. For more information, see Configure an IP blacklist.
Custom Protection Policy: Create custom access control (ACL) or rate limiting policies for your website. For example, you can restrict specific API endpoints to certain IP addresses or user agents, or limit the request rate for certain types of requests. You can also use custom protection policies to defend against HTTP flood attacks, crawlers, or other specific web attacks.

Navigation: On the Website Protection page, click the Access Control/Throttling tab, and then navigate to the Custom Protection Policy section to configure the feature. For more information, see Configure a custom protection policy.
Account Security: Helps you identify and mitigate security risks on account-related endpoints, such as login and registration pages. This feature protects against credential stuffing, brute-force attacks, spam registration, weak password sniffing, and SMS verification abuse.

Navigation: On the Website Protection page, click the Web Security tab. In the Data Security > Account Security and click Configure Now to configure the feature. For more information, see Configure account security.

For comprehensive web intrusion operations

To meet your needs, configure the following protection features after you add your website:

Decoding Settings: To maximize protection accuracy, configure the content formats that the WAF protection engine decodes based on your application's encoding practices. Selecting the appropriate decoding methods helps WAF better inspect traffic. By default, WAF applies 13 decoding methods. You can deselect methods to avoid unnecessary parsing and potential false positives. We recommend that you enable the protection rules engine with its status on, set the mode to block, enable smart rule management, and select the Medium rule group for the protection rule group. In Decoding Settings, select all options (13 of 14) except Base64 decoding. The selected options include URL decoding, JavaScript Unicode decoding, Hex decoding, comment handling, whitespace compression, multipart parsing, JSON parsing, XML parsing, PHP serialization decoding, HTML entity decoding, UTF-7 decoding, Form parsing, and Gzip decoding.

Navigation: On the Website Protection page, click the Web Security tab. In the Web Intrusion Prevention > Protection Rules Engine and configure its Decoding Settings. For more information, see Configure the protection rules engine.
Protection Rule Group: Customize the built-in rule sets to create a collection of protection rules that best fits your system architecture, framework, and middleware. Use this rule group to define your website's overall web intrusion prevention strategy. For policies that target a single URL, use a custom protection policy.

Navigation: In the WAF console, choose Systems > Protection Rule Group. Create a custom rule group for web attack prevention and apply it to your website. For more information, see Custom protection rule groups. WAF provides three default protection rule groups: Loose rule group (1,355 rules), Strict rule group (1,390 rules), and Medium rule group (1,347 rules). On the protection rule group page, you can Apply to Website, Edit, Copy, or Delete a rule group.
Custom Protection Policy: Create custom access control (ACL) or rate limiting policies for your website. For example, you can restrict specific API endpoints to certain IP addresses or user agents, or limit the request rate for certain types of requests. You can also use custom protection policies to defend against HTTP flood attacks, crawlers, or other specific web attacks.

Navigation: On the Website Protection page, click the Access Control/Throttling tab, and then navigate to the Custom Protection Policy section to configure the feature. For more information, see Configure a custom protection policy.
Positive Security Model (Alert mode): The positive security model learns your domain's normal traffic patterns to build a security model. This model includes details such as request parameter types, lengths, and whether they are required. After the model is built, any request that deviates from it triggers an alert. The Alert mode helps you effectively discover anomalies and threats in your traffic. If the detected requests are irrelevant to your business, you can switch to Block mode.

Navigation: On the Website Protection page, click the Web Security tab. In the Advanced Protection > Positive Security Model, turn on the Status switch, and set the Mode to Alert. For more information, see Configure the positive security model.
Scan Protection (High-frequency Web Attack Blocking, Directory Traversal Prevention, Scanner Blocking, and Collaborative Protection): The scan protection feature helps you mitigate threats from scanners by using multiple detection dimensions, including threat intelligence, scanner signatures, and behavioral analysis.

Navigation: On the Website Protection page, click the Access Control/Throttling tab, and then navigate to the Scan Protection section. Enable all sub-features and set appropriate thresholds. For more information, see Configure scan protection.

For strict security with zero missed detections

To meet your needs, configure the following protection features after you add your website:

Protection Rules Engine (Strict Rule Group)

Navigation: On the Website Protection page, click the Web Security tab. In the Web Intrusion Prevention > Protection Rules Engine and set the Protection Rule Group to Strict Rule Group. For more information, see Configure the protection rules engine.
Positive Security Model (Block mode): The positive security model learns your domain's normal traffic patterns to build a security model. This model includes details such as request parameter types, lengths, and whether they are required. After the model is built, any request that deviates from it is blocked. In high-security scenarios, enable Block mode directly.

Navigation: On the Website Protection page, click the Web Security tab. In the Advanced Protection > Positive Security Model, turn on the Status switch, and set the Mode to Block. For more information, see Configure the positive security model.
Scan Protection (High-frequency Web Attack Blocking, Directory Traversal Prevention, Scanner Blocking, and Collaborative Protection): The scan protection feature helps you mitigate threats from scanners by using multiple detection dimensions, including threat intelligence, scanner signatures, and behavioral analysis.

Navigation: On the Website Protection page, click the Access Control/Throttling tab, and then navigate to the Scan Protection section. Enable all sub-features and set appropriate thresholds. For more information, see Configure scan protection.
IP Address Blacklist: Blocks access requests from IP addresses and address ranges that are unrelated to your services, and from source IPs in specified geographic regions. For example, if a local government forum is not intended for users in other provinces, you can add those provinces to a region-level blacklist. If a website does not have users from Regions outside Chinese mainland, you can add Regions outside Chinese mainland to a region-level blacklist.

Navigation: On the Website Protection page, click the Access Control/Throttling tab, and then navigate to the IP Address Blacklist section to configure the feature. For more information, see Configure an IP blacklist.

For protection against crawlers and data risks

To meet your needs, configure the following protection features after you add your website:

Data Risk Control: This feature is ideal for protecting specific API endpoints, such as those for logins, registrations, and order placements, from automated traffic generated by scripts and tools.

Note
Data risk control relies on JavaScript injection and is applicable only to web environments. Do not enable this feature for mobile apps.

Navigation: On the Website Protection page, click the Bot Management tab, and then navigate to the Data Risk Control section to configure the feature. For more information, see Configure data risk control.
Data Leakage Prevention: This feature filters server responses to prevent exposing sensitive information, such as ID card numbers, bank card numbers, phone numbers, and sensitive keywords, in error pages or response bodies. The sensitive data is masked.

Navigation: On the Website Protection page, click the Web Security tab, and then navigate to the Data Security > Data Leakage Prevention section to configure the feature. For more information, see Configure data leakage prevention.
Website Tamper-proofing: This feature helps you protect specific website pages. When a protected page is requested, WAF serves a cached copy of the page to prevent it from being tampered with.

Navigation: On the Website Protection page, click the Web Security tab, and then navigate to the Data Security > Website Tamper-proofing section to configure the feature. For more information, see Configure website tamper-proofing.
Custom Protection Policy: For example, you can enable JavaScript challenges for frequently crawled static pages to block most scripts and automated programs. You can also use fine-grained frequency controls to trigger slider CAPTCHAs for sessions with excessive access rates.

Navigation: On the Website Protection page, click the Access Control/Throttling tab, and then navigate to the Custom Protection Policy section to configure the feature. For more information, see Configure a custom protection policy.
Account Security: Helps you identify and mitigate security risks on account-related endpoints, such as login and registration pages. This feature protects against credential stuffing, brute-force attacks, spam registration, weak password sniffing, and SMS verification abuse.

Navigation: On the Website Protection page, click the Web Security tab. In the Data Security > Account Security and click Configure Now to configure the feature. For more information, see Configure account security.
Authorized Crawler: Whitelists legitimate search engine crawlers, such as Google, Bing, Baidu, Sogou, and Yandex, allowing their requests to access your domain name.

Navigation: On the Website Protection page, click the Bot Management tab, and then navigate to the Authorized Crawler section to configure the feature. For more information, see Configure authorized crawler rules.
Bot Threat Intelligence: Uses threat intelligence rules from multiple data sources, including dial-up IP pools, data center IPs, malicious scanner IPs, and a real-time malicious crawler database generated on the cloud, to block malicious crawler requests across your entire domain or for specific paths.

Navigation: On the Website Protection page, click the Bot Management tab, and then navigate to the Bot Threat Intelligence section to configure the feature. For more information, see Configure bot threat intelligence rules.
App Protection: Secures native mobile applications, including trusted communication and protection against bot scripts. It effectively identifies requests from proxies, emulators, and apps with invalid signatures.

Navigation: On the Website Protection page, click the Bot Management tab, and then navigate to the App Protection section to configure the feature. For more information, see Configure app protection.