The protection configuration feature of Web Application Firewall (WAF) combines protection modules such as Core Protection Rule, HTTP Flood Protection, and Bot Management to defend against web attacks, including SQL injection, cross-site scripting (XSS), HTTP flood attacks, and malicious crawlers.
How it works
Protected objects and protected object groups: When you add a domain name or cloud service instance to WAF, the system automatically creates a protected object for it. You can group multiple protected objects into a protected object group for centralized management.
Protection modules: WAF provides various protection modules, such as Core Protection Rule, API Security, and Bot Management. To enable a protection module, create a protection template for it. Enable modules based on your business requirements.
Protection templates: A protection template is a collection of protection rules that defines rule content and scope. It consists of three components: template type, protection rules, and effective object.
Template type: Some protection modules provide two template types: a default protection template and a custom protection template. A default protection template does not require you to specify an effective object. It automatically applies to all existing and newly added protected objects.
Protection rule: Defines the detection logic and response action.
Effective object: Specifies the target of a protection template. By configuring an effective object, you can apply the template's rules to specific protected objects or protected object groups.
Configuration process
After you add resources to WAF, the system automatically creates protected objects. To view them, go to the page.
Select a protection module based on your business requirements. For example, to use the Custom Rule module, create a protection template. For more information, see Create a protection template.
After you create a template, add protection rules to it. For more information, see Add protection rules to a protection template.
Finally, select the protected objects for the protection template. For more information, see Set the effective objects for a protection template.
Supported protection modules
The supported protection modules vary based on the WAF edition. For example, the Subscription Basic edition does not support the Peak Traffic Throttling module. For more information about the differences, see Editions and Features.
Common core web protection modules
Protection module | Use cases and recommendations | Initial status |
Defends against common web application attacks such as SQL injection, cross-site scripting (XSS), code execution, webshell uploads, and command injection using Alibaba Cloud's built-in protection rule set. Keep the default configuration and make adjustments only to handle false positives. | Includes a default protection template, which is enabled by default in Block mode. By default, this module protects all resources added to WAF and automatically blocks attack requests. | |
Protection Rule Group (For legacy WAF instances only) Note This module has been upgraded to the Engine Configuration feature. For more information, see Announcement. | The Core Protection Rule module references these rule groups. We recommend that you keep the default configurations. | The Medium, Strict, and Loose rule groups are provided. The Medium rule group is applied by default. You can switch groups to handle false positives or false negatives. |
If you identify IP addresses that frequently send malicious requests, add them to an IP blacklist. | No default protection template is provided. | |
Use custom rules with flexible match conditions and rule actions to build personalized protection policies against specific attacks such as malicious API calls, malicious requests, and high-frequency scans. | ||
If attacks originate from a region where you have no legitimate business users, you can block all client IP addresses from that region. | ||
Identifies scanning behavior and scanner signatures to block large-scale scanning attempts against your site. This reduces intrusion risks and unwanted scan traffic. | Only the Subscription Advanced, Enterprise, and Ultimate editions include a default protection template that is enabled by default. Other editions do not include a default protection template. | |
Mitigates HTTP flood attacks using built-in generic protection algorithms. For better protection, use this module together with the Custom Rules module. |
Other core web protection modules
Protection module | Use cases and recommendations | Initial status |
Locks specific web pages to protect them from malicious tampering. When a client requests a locked page, WAF returns a cached version. | No default protection template is provided. | |
Filters server response content, such as exception pages or keywords, to mask sensitive information like ID card numbers and bank card numbers. | ||
Sets a throttling ratio or QPS threshold based on conditions such as URL and region. Suitable for handling traffic surges during promotional events and helps ensure origin server availability. |
Whitelist
Use cases and recommendations: Unlike other protection modules, the whitelist module lets requests with specific characteristics bypass protection. When enabled, requests that meet the specified conditions bypass all or specific protection modules. Add known trusted requests, such as requests from the IP addresses of O&M engineers, to a whitelist.
Initial status: This module provides a default template with no rules defined. The template is enabled by default.
Advanced protection features
Protection module | Use cases and recommendations | Initial status |
If your business relies on a large number of APIs, such as those for app or mini program backends, and you are concerned about unauthorized access, sensitive data leakage, or exposure of internal APIs, enable API Security. It automatically discovers API assets, identifies risks, and provides remediation suggestions and compliance references. | Not applicable. | |
Automated tools often lead to issues such as data scraping, business fraud, spam registration, malicious scalping, promotional abuse, and abuse of SMS interfaces. After you enable Bot Management, you can create precise protection policies based on traffic analysis to protect core data assets and reduce server load. | No default protection template is provided. | |
Provides security for major events during specific periods, with more precise and customized protection modes. | ||
If your AI application provides services over the internet and requires protection against prompt injection and non-compliant content generation, enable AI Application Protection. It automatically identifies high-risk requests, blocks attacks, and ensures the security and compliance of model outputs. |
Disable WAF protection
To temporarily disable WAF protection, go to the Protected Objects page in the WAF console and turn off the WAF Protection Status switch in the upper-right corner.
When the switch is turned off, traffic to the website temporarily bypasses the WAF protection engine and is no longer logged. After you complete emergency testing or other operations that require WAF to be temporarily disabled, turn on this switch as soon as possible to reduce the exposure risk of your assets.
Billing: For pay-as-you-go WAF instances, you are still charged for feature usage fees, basic traffic fees, and API security traffic fees (if API Security is enabled) after you turn off this switch.
API Security notice: The detection process of the API Security module is not affected by this switch.
Unsupported features: This feature is not supported for Microservices Engine (MSE) and Function Compute (FC) instances added through cloud service access. For hybrid cloud access, a specific version is required. For more information, contact your account manager.
Manage templates by type
To configure separate protection rules for different protected objects, you can define multiple protection templates within a protection module for fine-grained control. To manage these templates efficiently, understand the two template types: the default protection template and the custom protection template.
Template type | Description | Use cases |
Default protection template |
| Deploy general protection rules that must be enforced globally. |
Custom protection template | You must specify which protected objects or object groups the template applies to. | Deploy fine-grained protection rules for specific business scenarios, such as login or payment interfaces. |
A protected object is not protected by WAF if it is not associated with any template (its status is "Ineffective" in all templates).
A
Defaulttag marks the default protection template. Other templates are custom protection templates.
Protection modules that support default protection templates: Core Protection Rule, Whitelist, IP blacklist, Custom Rules, HTTP Flood Protection, Scanning Protection, Geo-blocking, and Peak Traffic Throttling.
Protection modules that do not support default protection templates: All templates created in these modules are custom protection templates. You must manually specify the effective objects.
Apply multiple templates to an object
The following protection modules also support associating multiple protection templates with a single protected object or object group:
Whitelist, IP blacklist, Custom Rules, Bot Management, and prompt injection protection.
In these modules, adding a protected object to or removing it from a custom protection template does not affect the scope of the default template.
For example, in modules that do not support applying multiple templates, such as Core Protection Rule, associating an object with a custom template causes WAF to automatically remove it from the default template.
Example 1: Use Monitor mode for new objects
Take the Core Protection Rule module as an example. This module has an initial default protection template whose Action is Block. This template is applied to all new protected objects that are added to WAF.
To use Monitor mode (log requests that match a rule without blocking them) for newly added objects and Block mode for existing objects, perform the following steps:
Set the Action of the default protection template to Monitor.
Create a Core Protection Rule template (a custom protection template), set its Action to Block, and set the Apply To parameter to all existing protected objects.
Example 2: Configure a custom whitelist
Take the Whitelist module as an example. This module has an initial default protection template with no rules defined. The protection template is enabled by default.
If you want to configure a whitelist rule to allow traffic from IP1 for all objects protected by WAF, and a specific protected object needs to allow traffic from IP1 and also from IP2, you can configure the settings as follows.
In the default template, add a rule to allow requests from
IP1. By default, all protected objects and groups are selected as effective objects.Create a whitelist template (a custom protection template), add a rule to allow requests from
IP2, and set the Apply To parameter to the specific protected object.
FAQ
When to manually configure protected objects
You must manually configure protected objects in the following scenarios:
When using the cloud service access method where multiple domain names resolve to the same cloud service instance, you must add each domain name as a separate protected object to configure different protection rules for them. For more information, see Manually add a protected object.
When you need to configure advanced features such as WAF cookie issuance, WAF decoding, and account extraction, you must manually configure protected objects. For more information, see Configure advanced protection behavior for a protected object.
How to verify protection is effective
Go to the Protected Object page, find the target object, and click View Protection Rule in the Actions column. On the Core Web Protection page, view the protection rules configured for the object. If the configured protection template does not appear on the Core Web Protection page, the template is not in effect. Recheck the template's effective object settings.
Handling false positives
Go to the page. Search for the request based on criteria such as request time, client IP address, or request URL to identify the protection module and rule that the request triggered.
If you confirm that the request is a false positive, go to the Logs section at the bottom of the page, locate the specific request, and click Suppress False Positive in the Actions column to create a whitelist rule.