Security
WAF and protection rules
The WAF reduces common attacks but does not replace application fixes.
#Overview
The WAF reduces common attacks but does not replace application fixes.
#Compose a readable policy
Enable the appropriate mode, then add precise country, IP, or supported custom rules. Order and action determine whether a request is allowed, blocked, or challenged.
Challenge customization changes the visitor page, not the validation mechanism. After editing, follow edge synchronization and use preview before exposing traffic.
#Deploy a rule
Describe the threat and expected legitimate exception.
Create the narrowest possible rule.
Preview the challenge and save.
Synchronize, test one blocked and one legitimate request, then monitor.
#State lifecycle
| State | Meaning |
|---|---|
pending | Policy compiled; application acknowledgement is pending. |
ok | Policy hash confirmed by the POP. |
legacy_unverified | Response accepted without hash proof; verification is limited. |
failed | The POP did not accept or confirm the policy. |