Configure a custom protection policy - Web Application Firewall

Custom protection policies allow you to create tailored access control rules and rate limiting rules based on precise match conditions. You can use these policies for scenarios like hotlink protection or securing your website's administrative backend. This topic shows you how to configure a custom protection policy.

Background

Custom protection policies use custom rules, which fall into two categories:

ACL rules: Filter requests based on precise match conditions that you define for fields such as the client IP address, request URL, and common request headers.
http flood protection rules: Filter malicious requests by defining rate limiting conditions in addition to precise match conditions.

Limitations

The number and specifications of custom rules that you can configure depend on the edition of your subscription Web Application Firewall (WAF) instance.

Specification	Description	Pro edition	Business edition	Enterprise and later
Number of custom rules	The maximum number of custom rules that you can add.	200 per domain name	200 per domain name	200 per domain name
Advanced match fields	Lets you use advanced match fields other than IP and URL in a rule's match conditions.	Not supported	Supported	Supported
Rate limiting	Lets you enable rate limiting in a custom rule, which creates an http flood protection rule.	Not supported	Supported	Supported
Custom statistical objects	Lets you use custom statistical objects other than IP and Session for rate limiting.	Not supported	Supported	Supported

Prerequisites

You have activated a Web Application Firewall instance.
Your website has been added to WAF. For more information, see Tutorials.

Procedure

Log on to the Web Application Firewall console.
In the top menu bar, select the resource group and region for your Web Application Firewall instance (Chinese Mainland or Outside Chinese Mainland).
In the left navigation pane, choose Protection Config > Website Protection.
On the Website Protection page, switch to the domain name to configure.
Click the Access Control/Throttling tab, locate the Custom Protection Policy section, turn on the Status switch, and click Configure Now.
Note
After you enable the custom protection policy, the policy inspects all requests to your website by default. You can configure a whitelist for access control and throttling to allow specific requests to bypass this inspection. For more information, see Configure a whitelist for access control and throttling.

Create a custom rule.

On the Custom Protection Policy page, click Create.

In the Create Rule dialog box, configure the following settings: Rule Name, Match Conditions (set the match field, logical operator, and match content. An AND operator is used to combine up to five conditions.), Rate Limiting (enable this feature by using the switch. Rate limiting is triggered when a precise condition is met.), Action (such as Monitor), and Protection Type (HTTP Flood Protection or ACL).

Parameter	Description
Rule Name	Specify a name for the rule.
Match Condition	Define the detection logic for the rule. Only requests that meet the match conditions trigger the rule. Click Add Condition to set up to five conditions. If multiple conditions are specified, all of them must be met for a request to be considered a match. For more information about the fields, see Match condition fields.
Rate Limiting	Enables or disables rate limiting. The rate check is performed after a request meets the match conditions. If you enable this feature, you must configure the parameters for rate limiting. The Rate Limiting panel includes the following settings: Statistical Object (such as IP), Interval (Seconds), Threshold (Times), Status Code (optional, can be set by amount or percentage), Effective Scope (Current feature match scope or Domain scope of the current rule), Action (such as Monitor), Timeout (Seconds), and Protection Type (http flood protection or ACL). For more information, see Rate limiting parameters.
Action	Specifies the action to take on requests that trigger the rule. Valid values: Monitor: Logs the alert but allows the request. Block: Blocks the request. Run Slider CAPTCHA: Redirects the request to a page for CAPTCHA verification. Run Strict Slider CAPTCHA: Redirects the request to a page for strict CAPTCHA verification. Run JavaScript Validation: Triggers JavaScript validation. If you enable Rate Limiting, you must also specify the Timeout Period (Seconds), which is the duration for which the action remains in effect. Note Because WAF aggregates data from multiple servers in a cluster to calculate the request rate, a slight delay may occur in the statistical process. As a result, the action may take effect with a short latency. The JS validation and CAPTCHA actions in a custom protection policy apply only to static pages. To support asynchronous requests, such as those initiated by XMLHttpRequest or Fetch, enable JS validation and CAPTCHA in the Bot Management module. For more information, see Configure scenario-based bot protection rules for web browsers.
Protection Type	The type of custom rule. This parameter is set automatically based on whether you enable Rate Limiting. If rate limiting is enabled, the value is HTTP Flood Protection. If rate limiting is disabled, the value is ACL.

The following table describes the parameters for rate limiting.

Parameter	Description
Statistical Object	The basis for counting requests. Valid values: IP: Counts requests from a single source IP address. If you use a CNAME record to add your service to WAF and a Layer 7 proxy such as a CDN is deployed in front of WAF, you must enable the "Is a Layer 7 proxy (such as Anti-DDoS or CDN) deployed in front of WAF?" option. Otherwise, WAF cannot obtain the real client IP addresses. Session: Counts requests from a single session. Custom Header: Counts requests that have the same custom header content. Custom Parameters: Counts requests that have the same custom parameter content. Custom Cookie: Counts requests that have the same custom cookie content.
Interval (Seconds)	The time interval in seconds for counting requests.
Threshold (Occurrences)	The maximum number of requests allowed from a statistical object within the specified interval. If the number of requests exceeds this threshold, rate limiting is triggered.
Status Code	This check is performed after the primary detection logic. It validates the number or percentage of a specific Status Code in responses within the interval. You can set the limit by amount or percentage. Quantity: The maximum number of times the specified status code is allowed. Percentage (%): The maximum percentage of responses that can have the specified status code.
Effective Scope	The scope in which the rate limiting check is effective. Valid values: Feature Matching Objects: Counts only the requests that meet the Match Condition of the current rule. Applied Domain Names: Counts all requests to the current domain name.

Click Save.

After you successfully add a custom protection policy rule, it is enabled by default. You can view the new rule in the rule list and disable, edit, or delete it as needed.

FAQ

False positives with 'contains' logic

Cause: When you select Include as the logical operator in a Match Condition, any request URL that includes the specified string will match. If the match string is too short, it can unintentionally match other paths that contain it as a substring, causing false positives.
Solution: Change the logical operator to Equal To or Prefix Match to narrow the match scope. You can also add other fields like Match Condition or Header to the match condition to make the criteria more specific and improve accuracy.
Recommendation: Before you deploy the rule, set the Action to Monitor. Review the protection logs to confirm that the rule matches only the intended requests. After verification, you can change the action to Block.

Block a specific URL

Create a new custom protection policy. Set the Match Condition to the target URL (we recommend using the Equal To or Prefix Match operator) and set the Action to Block. Requests that do not match this rule are allowed by default.

Related operations

After you configure a protection policy, you can set up alerts with CloudMonitor or Log Service. WAF can then send notifications when website traffic matches a protection rule, keeping you informed of your services' security status. For more information, see Configure alerts.