Check what the WAF refused and tune it

The Protection page answers three questions across every node: is the WAF on where it should be, is it refusing the right people, and who is banned at the firewall right now. You use it after you turn the WAF on for a site, and whenever a customer reports a page that will not load.

The page covers the last 7 days. Each node keeps its own WAF records, and the page merges them. Only an Owner or an Administrator sees it.

Before you start

• At least one site has a WAF level other than Off. See Turn on the web application firewall for a site.
• The brute-force scanner is on if you want the page to show automatic bans. See Tune automatic bans.

Steps

Read the verdict and the tiles

1. Open Protection in the sidebar, under Security.
2. Read the line under the title. It is one of:
   • “No sites yet — nothing for the WAF to protect.”
   • “The WAF is off on all N sites — nothing is being filtered.”
   • “N rule(s) may be turning away real visitors — see “Tuning” below.”
   • “WAF on X of Y sites · N requests refused in 24 h · M addresses banned now.”
3. Read the tiles under At a glance:
   • Refused · 24 h, with the 7-day count beneath.
   • Banned now, with the number of bans this week and their kinds.
   • Sites with the WAF on, as “N of M”, split into strict and standard or custom.
   • Possible false positives: rules refusing mostly real browsers.
4. If Automatic bans off on appears, those nodes run with the scanner switched off. Refusals are still recorded there, and nothing earns a ban.

Two notices can appear above the verdict. Incomplete view names nodes that did not answer, whose sites, refusals and bans are missing. A note about a node on an older version says only its active bans are shown until it is updated.

Find a rule that refuses real visitors

1. Look at Refusals · 7 days. The chart shows refusals per hour, split between those that count toward a ban and those that are refused only. A table under it lists each rule with its 24 h and 7 days counts and Leads to a ban: “yes, when repeated” or “never”.
2. Scroll to Tuning · rules per site. It works from each site’s last 200 refusals. Scanners and scripts do not send the headers a browser does, so a rule whose refusals come mostly from real browsers is probably stopping visitors.
3. A row is tagged possible false positive when at least 5 refusals were sampled and at least half came from real browsers. The columns are 7 days, Browsers (the share, in percent), Addresses and Latest request.
4. Click the site’s name to read the request on its WAF activity card. If the request is legitimate, click Allow on the row and confirm “Turn off “<rule>” on <site>?”.

Before you click Allow

Allow turns the rule off for every request on that site, not only for the one you looked at. The vhost is re-checked with nginx -t first.

There is no backup to check. Note the rule’s name before you confirm. To undo it, open the site’s Settings & limits tab, open Individual rules on the Protection card, set the rule to Follow the level and click Save protection. A row for a rule you turned off carries the tag turned off since.

See who is being refused

Busiest addresses lists up to 20 addresses with at least 5 recent refusals, or any address that is banned. A browser tag means most of its refused requests came from a real browser. Status reads “refused only” or names the ban.

Find sites without a WAF

Open Sites without the WAF. It lists each site with its node and a Turn on link that opens the site’s Protection card. The section opens by itself when no site has the WAF on. Standard is the level the page recommends for almost every site.

Review bans

The Banned now and Ban history · 7 days sections are covered in Review, add and lift IP bans. The Ban thresholds button at the top opens the scanner settings for users who can manage Settings.

Check that it worked

• Sites with the WAF on matches the number of sites you set to Standard or Strict.
• After you click Allow, the rule’s row shows the tag turned off since, and the verdict no longer counts it as a possible false positive.
• A site whose level you changed appears in Refusals · 7 days once a rule has refused a request.

If it fails

• “Nothing refused — the WAF is not on for any site yet.”: no site has a level other than Off. Turn it on per site.
• “Nothing refused in the last 7 days.”: the WAF is on and nothing matched a rule.
• Allow is missing from a row: your user cannot edit hostings, or the row’s entry is not a built-in rule, such as a country or bot refusal. Change those on the site’s Protection card.
• A node’s sites are missing: see the Incomplete view notice. Check the node’s connection on the Nodes page.