When bot traffic bypasses your standard controls—using fingerprint evasion, SDK-collected signals, or unusual request patterns—advanced custom rules give you precise control. Unlike basic custom rules, advanced custom rules support additional match fields: Client-ID, JA3/JA4 fingerprints, HTTP/2 fingerprints, and data collected by the Web SDK and App SDK. They also support deduplication when counting request frequency.
This topic explains how to create a protection template and add access control or frequency control rules to it.
A protection template is the container for your rules. Rules only take effect after you associate the template with protected objects.
Log on to the Web Application Firewall 3.0 console. In the top navigation bar, select a resource group and a region (Chinese Mainland or Outside Chinese Mainland).
Click Create Template. In the New Template - Advanced Custom Rules panel, configure the following settings, then click OK.
Parameter Description Template name A name for the template. Length: 1–255 characters. Allowed characters: Chinese characters, uppercase and lowercase letters, digits, periods (.), underscores (_), and hyphens (-). Rule configuration Click Create Rule to add a rule now, or skip this and add rules after the template is created. Apply to Select the protected objects or object groups to which this template applies.
The template is enabled by default. In the template list, you can:
View the number of Protected Object/Group entries associated with the template
Toggle the Status switch to enable or disable the template
Click Create Rule to add a rule
Edit, Delete, or Copy the template
Click the
icon next to the template name to view the rules inside
Match field reference
The following table lists all match fields available when building rule conditions.
| Match field | Description | Supported logic |
|---|---|---|
| URI | The full path of the request, including the query string but excluding the domain. Must start with /. Example: /login.php. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with |
| IP | The source IP address of the request. Supports IPv4 (e.g., 1.XX.XX.1), IPv6 (e.g., 2001:db8:ffff:ffff:ffff:ffff:ffff:ffff), and CIDR blocks (e.g., 1.XX.XX.1/16). Press Enter after each address. Maximum: 100 addresses. | Belongs to, Does not belong to |
| Referer | The URL of the page that linked to the current request. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with, Is empty, Exists, Does not exist |
| User-Agent | The client identifier string, which includes browser type, version, and rendering engine details. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with, Is empty, Exists, Does not exist |
| Query string | The part of the URL after the question mark (?). | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Exists, Does not exist |
| Cookie | Cookie data in the request. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Exists, Does not exist, Is empty |
| Content-Type | The Multipurpose Internet Mail Extensions (MIME) type of the request body, specified in the Content-Type header. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex |
| Content-Length | The size of the request body in bytes. Range: 0–2,147,483,648. | Equals, Value is less than, Value is greater than |
| X-Forwarded-For | The original client IP address when the request passes through an HTTP proxy or load balancer. This field is only present in forwarded requests. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Does not exist |
| Body | The request body content. | Contains, Does not exist, Equals, Matches regex, Starts with, Ends with |
| Http-Method | The HTTP method of the request (GET, POST, DELETE, PUT, OPTIONS, CONNECT, HEAD, TRACE, or PATCH). | Equals, Does not equal, Equals one of, Does not equal any of |
| Header | A request header field. Supports custom header names. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Exists, Does not exist |
| URI Path | The path portion of the URI, excluding the query string. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with |
| Query string parameter | A specific parameter name in the query string. For example, in www.aliyundoc.com/path?param1=a¶m2=b, param1 and param2 are query string parameters. Parameter names are case-sensitive. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with, Exists, Does not exist, Is empty |
| Client-ID | An identifier for the client (browser or application), derived from User-Agent information and traffic fingerprints. | Contains, Does not contain, Equals, Does not equal, Equals one of |
| Server-Port | The destination port of the request on the server. | Equals, Does not equal, Equals one of, Does not equal any of |
| File extension | The file extension at the end of the request path. Example: .png or .php. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with, Exists, Does not exist, Is empty |
| Filename | The filename at the end of the request path. For example, in /abc/index.php, the filename is index.php. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with, Exists, Does not exist, Is empty |
| Host | The domain name in the request. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with, Exists, Does not exist, Is empty |
| Cookie name | A specific cookie name. For example, in acw_tc:111, the cookie name is acw_tc. Cookie names are case-sensitive. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with, Exists, Does not exist, Is empty |
| Body parameter | A specific parameter name in the request body. For example, in a=1&b=2, a and b are parameter names. The value must be longer than 4 characters for WAF to detect it. Parameter names are case-sensitive. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with, Exists, Does not exist, Is empty |
| JA3 fingerprint | An MD5 hash of key TLS handshake parameters—TLS version, cipher suites, compression algorithms, and TLS extensions. The resulting string identifies the TLS configuration of a client and can distinguish browsers, mobile apps, and malware. | Equals, Does not equal, Equals one of |
| JA4 fingerprint | An extension of JA3 that incorporates additional context such as browser version and operating system. This reduces fingerprint collisions and more accurately distinguishes real users from automated clients, lowering the false positive rate. | Equals, Does not equal, Equals one of |
| HTTP/2 fingerprint | An MD5 hash of the original HTTP/2 client fingerprint, used to identify and analyze different HTTP/2 clients. | Equals, Does not equal, Equals one of |
| IDC | Identifies whether traffic originates from a data center, based on source IP attribution. Attackers often use low-cost cloud servers to launch attacks, and this field helps flag such traffic. | Equals one of, Does not equal any of |
| Web SDK | Probe data collected by the Web SDK, such as the web UMID and the count of keyboard, mouse, or touch events. Use this to detect unusual browser behavior. | Equals, Value is greater than, Value is less than |
| App SDK | Probe data collected by the App SDK, enabling fine-grained control over mobile app traffic. | Contains, Does not contain, Equals, Does not equal, Length is less than, Length is equal to, Length is greater than, Equals one of, Does not equal any of, Contains one of, Does not contain any of, Matches regex, Does not match regex, Starts with, Ends with, Exists, Does not exist, Is empty |