Configure core web protection rules and rule groups - Web Application Firewall

Use core web protection rules to automatically detect and block common web application attacks targeting your services. This topic explains the module's components and walks through how to create custom rule groups and protection templates.

Important

This topic covers the original version of the core protection module. If you have upgraded to the new WAF console or are using the core protection module for the first time, see Core web protection rules and rule groups. For details about the upgrade, see Announcement of upgrading the basic protection rule module in WAF 3.0. You can determine which version you are using by checking the Core Protection Rule style on the Protection Config > Core Protection Rule page in the WAF console.

New version	A built-in rule set based on security protection experience that defends against common web application attacks such as SQL injection, XSS, code execution, webshell upload, and command injection. Click Create Template to create a protection rule template.
Old version	A built-in rule set based on security protection experience that defends against common web application attacks such as SQL injection, XSS, code execution, webshell upload, and command injection. You can click Create Template to create a protection template, or click Rule Group Management to manage rule groups.

Background information

Decoding

The core protection rules support decoding in 23 formats, including:

Parsing of structured data formats such as JSON, XML, and Multipart to improve detection accuracy.
Identification of encoding bypass techniques such as Unicode and HTML entity encoding to improve detection recall.

Detection modules

The core protection module uses three detection modules:

Rule Protection (enabled by default)

A pattern-matching protection method that relies on predefined rule groups to identify known attack patterns and defend against common web application attacks.

WAF provides three built-in rule groups based on protection strictness:

Rule group	When to use it
Loose Rule Group	Use if your application generates frequent false positives with the Medium group, or if you run tools that produce SQL-like query strings (such as phpMyAdmin or Adminer). This group has lower detection sensitivity and fewer false positives.
Medium Rule Group (default)	Suitable for standard web applications. Provides balanced detection coverage with reasonable false-positive rates. Select this if you are unsure.
Strict Rule Group	Suitable for high-security environments where maximizing detection coverage takes priority over the risk of occasional false positives.

You can also configure custom rule groups based on your business needs.

Semantic Protection (enabled by default)
A more intelligent protection method that analyzes request content and context to understand semantics and syntax structure. This helps identify unknown attack patterns and defends against SQL injection attacks.
Intelligent O&M (disabled by default)
Uses AI learning based on historical business traffic to identify rules that are not applicable at the URL granularity and automatically adds whitelists, effectively reducing the risk of false positives.

Protection templates

Template		Default protection template	Custom protection template
Created by		System (automatically provided)	User (manually created)
Detection module	Rule Protection	Enabled by default. Applies the Medium Rule Group in Block mode.	Customizable. You can select any rule group (default or custom) and configure the action.
	Semantic Protection	Enabled by default. Applies Log mode and enables the Complete SQL Statement Detection switch for non-injection attacks.	Customizable. Configure the action and enable or disable Complete SQL Statement Detection based on your business needs.
	Intelligent O&M	Disabled by default.	Enable or disable the Intelligent Whitelist based on your business needs.
Applied to		Applies by default to protected objects or object groups that are not associated with a custom protection template.	The protected objects or object groups you select.

Prerequisites

A WAF 3.0 instance is created.
To create a custom rule group, your instance must be a subscription instance of the Enterprise or Ultimate edition, or a pay-as-you-go instance.
Web services are added to WAF as protected objects. For more information, see Configure protected objects and protected object groups.

Create a custom rule group

You can create a custom rule group from scratch or base it on one of the built-in rule groups.

Log on to the WAF 3.0 console. In the top navigation bar, select the resource group and region of your WAF instance. The available regions are Chinese Mainland and Outside Chinese Mainland.
In the left-side navigation pane, choose Protection Config > Core Protection Rule.
In the Core Protection Rule section, click Rule Groups.
On the Rule Groups page, click Create Rule Group.

Configure the basic information for the rule group and click Next.

Important

After the rule group is created, the basic information cannot be modified.

Parameter	Description
Rule Group Name	Letters, digits, periods (`.`), underscores (`_`), and hyphens (`-`) are allowed.
Create Template	Create from Scratch: No base template. Add rules manually. Automatic Update is disabled and cannot be enabled. Use Default Rule Group: Start from Loose, Medium, or Strict Rule Group. Automatic Update is available.
Automatic Update	When enabled, rules added to or removed from the selected default rule group are automatically synced to this custom rule group. This setting cannot be changed after the rule group is created, and is only available when Select Protection Template is set to Use Default Rule Group.

On the Configure Protection Rules page, click Add Rule. In the dialog box that appears, filter rules by entering a Rule ID or Detection Module/CVE ID, or by setting Risk Level, Protection Rule Type, or Application Type. Select the rules you want to add from the rule library and click Add, or click Add All to add all filtered rules.
Note
- If you set Select Protection Template to Use Default Rule Group in step 5 and the rules you want to add already exist in the rule library, you can skip this step.
- Rules in the rule list are sorted in descending order by update time.
After adding rules, if you need to remove any added protection rules, you can filter and select rules in the rule list by entering a Rule ID or CVE ID, or by setting Risk Level, Protection Rule Type, or Application Type, then click Remove. You can also click Clear All to start over.
Click Next. On the Complete page, click Complete.
After the rule group is created, you can perform the following operations in the rule group list:
- Click the number in the Number of Built-in Rules column to view the rules in the group.
- Click Edit, Copy, or Delete in the Actions column to manage the rule group.
  Note
  - The basic information of a rule group cannot be modified.
  - A copied rule group is named <original name>-copy by default and is not associated with any protected objects.
  - A rule group that is associated with a protection template cannot be deleted. To delete such a rule group, first remove its association with the core protection rule.

Create a custom protection template

In the left-side navigation pane, choose Protection Config > Core Protection Rule.
Scroll to the Core Protection Rule section and click Create Template.
Note
When creating a core protection template for the first time, you can also click Configure Now in the Core Protection Rule card at the top of the page.

In the Create Template panel, configure the following parameters and click OK.

Note

A newly created protection template is enabled by default.

Parameter	Description
Template Name	Letters, digits, periods (`.`), underscores (`_`), and hyphens (`-`) are allowed.
Save as Default Template	Sets this template as the default for the protection module. Only one default template is allowed per module. The default template automatically applies to all protected objects and groups not assigned to a custom template, including newly added objects.

Parameter	Description
Action	Block: Blocks matching requests and returns a block page. By default, WAF returns a built-in block page. Use the custom response feature to configure a custom page. Monitor: Logs matching requests without blocking. Use this mode to validate rules before enforcing them. Query logs on the Security Reports page — requires Simple Log Service for WAF to be enabled.
Rule Group Type	Default: Associate the template with a built-in rule group — Loose, Medium, or Strict. Custom: Select a custom rule group from the list. See Create a custom rule group.

Parameter	Description
Action	Block or Monitor — same behavior as the Rules Engine action above.
Complete SQL Statement Detection (enabled by default)	When enabled, WAF also intercepts requests containing complete SQL statements (for example, `/query.php?sql=select name from users where 1=1%23`). Disable this if your application uses database tools such as phpMyAdmin or Adminer. Incomplete SQL (for example, `/query.php?name='and 1=1%23`) is always inspected regardless of this setting.

Parameter	Description
Protocol Compliance	Attackers exploit differences in how languages handle HTTP request data formats. Protocol compliance checks whether data conforms to protocol-level standards, providing an effective defense against bypass attempts such as file upload evasion. Protocol compliance requires the Enterprise or Ultimate edition. The Advanced edition does not support it by default. It is billed separately on a pay-as-you-go basis.
Intelligent O&M	After you enable the Intelligent Whitelist switch, WAF uses AI learning based on historical business traffic to identify rules that are not applicable at the URL granularity and automatically adds whitelists, effectively reducing the risk of false positives. Automatically added whitelist rules are displayed under the AutoTemplate template in the whitelist rule list. For more information, see View whitelist rules. Note This feature is supported only on pay-as-you-go instances and subscription instances of the Enterprise or Ultimate edition.
Apply To	A protected object or object group can be associated with only one core protection rule template. If you set a default protection template, all protected objects and object groups that are not associated with a custom template are selected by default. If you do not set a default template, no objects are selected by default. You can manually modify the selected objects.

If you enabled the Intelligent Whitelist switch when creating the core protection template (the protection template is followed by the icon), you can click Delivery Record in the Actions column to view the intelligent whitelist delivery records. If you did not enable the Intelligent Whitelist switch (the protection template is followed by the icon), you can toggle the Intelligent Whitelist switch directly from the template list.

You can also click Rule Groups in the Core Protection Rule section to view the associations between rule groups and protection templates.

What to do next

View hit records for specific protection rules on the Core Protection Rule tab of the Security Reports page. In the attack event record area, click View Details for a specific Rule ID to see the full attack details. For more information, see Security Reports.

Important

The Core Protection Rule page does not support searching for specific core protection rules by Rule ID. If a rule incorrectly blocks normal traffic, configure a whitelist rule for that rule using the Whitelist module. For more information, see Configure protection rules of the whitelist module to allow specific requests.

References

For an overview of WAF 3.0 protection objects, modules, and the protection pipeline, see Overview.
To create a protection template via API, see CreateDefenseTemplate.
To create a core web protection rule and configure its content, see Configure the core protection rule module.