After you add your website to WAF, you can configure a website allowlist to let specific requests bypass all protection modules and access your origin server directly. Use this website allowlist for fully trusted traffic, such as requests from trusted vulnerability scanners or authenticated third-party APIs.
Prerequisites
-
You have activated a Web Application Firewall instance.
-
Your website has been added to WAF. For more information, see Tutorials.
Background information
WAF protects your website with multiple protection modules. By default, WAF inspects requests using all enabled modules.
You can also configure module-specific allowlists to let specific requests bypass only certain modules. The following module-specific allowlists are supported:
-
Web intrusion prevention allowlist: Allows requests to bypass the rule protection engine modules.
-
Data security allowlist: Allows requests to bypass the sensitive data leakage prevention, website tampering prevention, and account security modules.
-
Bot management allowlist: Allows requests to bypass the crawler threat intelligence, data risk control, intelligent algorithm, and app protection modules.
-
Access control/rate limiting allowlist: Allows requests to bypass the CC attack protection, IP blocklist, scan protection, and custom rules modules.
We strongly recommend using module-specific allowlists when possible. More specific rules improve security, making a module-specific allowlist a more secure option than a global one.
Procedure
-
Log on to the Web Application Firewall console.
-
In the top menu bar, select the resource group and region for your Web Application Firewall instance (Chinese Mainland or Outside Chinese Mainland).
-
In the left navigation pane, choose .
-
On the Website Protection page, switch to the domain name to configure.
-
In the upper-right corner of the page, click Website Whitelist.
-
Create an allowlist rule.
-
On the Website Whitelist page, click Create.
-
In the Create Rule dialog box, configure the rule parameters. A rule requires a rule name (up to 50 letters, digits, or Chinese characters) and one or more match conditions. You can add up to five conditions. If you add multiple conditions, a logical AND connects them. Each match condition consists of a match field (such as URL), a logical operator (such as contains), and the required match content. After you complete the configuration, click Save.
Parameter
Description
Rule Name
Specify a name for the rule.
Match Condition
Specifies the conditions that a request must meet. Click Add Condition to add up to five conditions. If you add multiple conditions, a request must meet all of them to match the rule.
For more information, see Match condition field reference.
-
Click Save.
After you add an allowlist rule, it takes effect automatically. You can then view, disable, edit, or delete the new rule from the rule list.
-