Break nothing at the start
A new site starts in detection mode: every request is inspected and recorded, nothing is blocked. Events say what would have been done.
False positives and detection mode
Observe first, block later: a new site only records, a report says what would have been blocked, each false positive becomes the narrowest possible exception, and you can simulate, roll out gradually and roll back.
Where to find it in the console : Console: Sites, then the Protection tab of the site (detection report, switch to blocking); Events (“This is a false positive”); False positives (analysis and suggestions); Exceptions.
What it is for
Understand every match
Each event shows the rule, the location (parameter, header…), the matched fragment and a plain-language explanation: what, where, why, what to do.
Fix it narrowly
“This is a false positive” proposes the narrowest exception first, with an expiry and a preview of its effect, instead of weakening the whole policy.
Always keep the way back
Switching to blocking is one click and is undone in one click: back to detection, or back to the previous policy version.
From observing to blocking
The recommended path: observe, review, simulate, switch, watch, keep the rollback ready.
1. Observe
Detection for the period you chose (7 days by default) to cover weekly cycles: batch jobs, campaigns, month-end screens.
2. Read the report
The detection report gives the volume, the share of traffic that would still be allowed, the attack families, the few rules behind most false positives, and proposed exceptions.
3. Handle the false positives
The False positives page groups would-be blocks by rule and location; accept a suggestion, dismiss it, or flag events yourself.
4. Simulate
Replay stored traffic against the policy you plan to run: newly blocked, newly allowed, the rules behind them. An exception is settled before you switch.
5. Switch to blocking
A button in the Protection tab of the site, or the command line. A gradual rollout exists: a share of the nodes, or a share of the requests.
6. Watch and roll back
Watch the blocked rate, the 4xx rate and tickets quoting an incident ID. Back to detection in one click, or back to the previous policy version.
Three exception scopes
The dialog proposes the narrowest first.
- The narrowest: this rule, this path and the offending parameter only.
- This path: this rule on every parameter under the same directory.
- The whole rule: this rule everywhere on the site (riskier).
- An expiry (30 days by default), a reason, and a preview: how many events the exception would cover, from how many addresses, at what risk level.
Other ways to fix it, in this order
Prefer them in this order.
- An exception, the narrowest.
- A per-rule or per-path mode: “detect” instead of “block” for one rule on one path.
- A lower paranoia level for a path.
- Fix the application (for example do not echo SQL-looking text into parameters).
- Raise the threshold or lower the scores: last resort, it weakens everything.
What is not done, or not proven
We prefer to say it plainly.
- Suggestions are only proposals: nothing is ever applied automatically.
- The report and the false-positive estimate rest on your own traffic: with few days observed or little traffic the report may be incomplete, and the console says so.
- Simulation replays stored events: it is limited by the number of requests asked for (2,000 by default) and by how long events are kept.
- An exception weakens protection for what it covers: prefer the narrowest, with an expiry. We publish no measurement of false-positive rates.
Use cases
An existing site to protect
You put it in detection mode, let a week of real traffic go through, then read the report before blocking.
An internal search box
Customers type “select your size from the list”: an exception limited to that search parameter, with an expiry, settles it.
One noisy rule on one path
You set that rule to detect on that path while the application is fixed, without touching the rest.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionFree Included in every offer, including both free offers (Free and Free +)Pro and above Paid offers: visible in the console, locked without a licence. From Pro, unless Agency or Enterprise is shown
Rules, policy and rollout
- False positives: from an event to the narrowest exception in one click, with a plain-language explanationFree
- Simulation: replay past traffic against a draft policyFree
- Detection report at the end of the observation period, with proposed exceptionsFree
- Progressive rollout: a share of nodes, a share of requests, or a single ruleFree
- Narrow exceptions by rule, parameter, path and address, with expiry and an impact previewFree
- Rule tests runnable in CI, with JUnit outputFree
Automatic rules
- Estimated false-positive rate per rule group and the Ready to block indicatorPro and above
Going back to the default of an advanced option is always possible. What happens when a paid licence ends is described in the pricing FAQ: 48 hours of grace, 48 hours of read-only, then WAF protection is switched off until renewal.
Pricing Read the documentation
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.