Web Application Firewall

Features

• 

  Web Application Protection

  Provides anti-attack solutions for Web applications. Virtually patches zero-day vulnerabilities and offers website stealth service.

  
  

  Common OWASP Attack Prevention

  Provides multiple protection policies to prevent SQL injection attacks, cross site scripting attacks, and web-shell uploading. Our service supports backdoor quarantine, and defends against command injection, illegal HTTP requests, common web server vulnerability exploiting, unauthorized access to core data, Path Traversal attacks, and vulnerability scanning.

  
  

  Zero-Day Vulnerability Protection

  WAF supports automatic protection to secure your servers. Our professional protection team provides virtual patching service to fix high-risk zero-day vulnerabilities within 24 hours.

  
  

  Website Stealth

  Uses DNS to redirect traffic to prevent server IP addresses from being exposed. Attack traffic cannot pass around WAF to reach your servers.

• 

  CC Attack Prevention

  Filters out bot traffic to guarantee the server performance.

  
  

  Precise Protection with Low False Positive Rate

  WAF does not directly blocks IP addresses that send requests too frequently. Instead, WAF recognizes suspicious activities based on URL requests, response code, and other signatures.

  
  

  100% Malicious Request Recognition and Blocking

  Recognizes attack signatures in common fields of request headers, including the IP, URL, User-Agent, and Referer fields.

  
  

  User-defined Rules for Business Protection

  The Enterprise Edition allows you to set rules to define the frequency of requests sent to a URL.

  
  

  Powerful Threat Intelligence

  Supports customized attack protection based on large amounts of IP address blacklists and crawler databases.

• 

  Business Security

  Supports risk control, anti-crawler, and anti-rush to protect your business.

  
  

  Quick Configuration

  Supports quick configuration to automatically protect your servers, without the need to modify the source code of your servers or call the APIs.

  
  

  Satisfying User Experience

  No verification is required for requests sent from user web browsers or applications. “Slide to verify” verification is required for suspicious requests that may be sent from bots. Precise Interception. Powerful device fingerprinting and bot recognition capabilities help to maintain normal business operations.

  
  

  Precise Interception

  Supports device fingerprints and bot recognition to ensure the operations of your business.

• 

  HTTPS-based Optimization

  Quick origin fetching over HTTP or HTTPS to reduce the load on the origin site.

  
  

  Quick HTTP-HTTPS Migration

  To migrate your website from HTTP to HTTPS, you only need to upload the certificates private key. You do not need to change the configurations of your server.

  
  

  Origin Fetching over HTTP.

  Supports origin fetching-based HTTPS-HTTP redirection to reduce the load on your origin site and improve business performance.

• 

  HTTP and HTTPS Access Control

  Supports multi-dimensional and precise HTTP and HTTPS traffic throttling.

  
  

  IP-based Access Control

  Supports blocking and whitelisting of specified IPs, network segments, and malicious IPs.

  
  

  URL-based Access Control

  Supports blacklisting and whitelisting of specified URLs.

  
  

  Variant CC Attack Prevention

  Prevents variant CC attacks, such as WordPress pingbacks.

  
  

  Crawler Prevention

  Blocks malicious requests, including python and libcurl requests.

  
  

  Backend Protection

  Only allows specified IP addresses to access certain URLs. For example, only administrators can log on to the back end.

  
  

  Anti-leech

  Secures website resources against malicious links from other web pages and malicious requests bound for non-existent links.

  
  

  Malicious Request Protection

  Intercepts malicious requests bound for non-existent links, and blocks mass attacks targeting at URLs that do not exist.

  
  

  Geo-Blocking

  The Enterprise Edition allows you to block IP addresses in specified geographical locations.

• 

  Log Management

  All logs support quick query.

  
  

  Smart Log Query

  All logs support smart query. This service allows you to search unusual requests and attack interception records with ease. You can obtain the status of your business running on your website.