Check what goes out too
A successful attack often shows in the response: data leak, webshell output, defaced page. ToutWAF inspects the response before it reaches the visitor.
Data protection (DLP)
What leaves your applications is checked too: a stack trace never reaches the visitor, banners are removed, bank cards, IBANs and keys leaking in a response are spotted, masked or blocked, and your logs hold no password or token.
Where to find it in the console : Protection menu: Data leak prevention; Privacy in Reports and compliance.
What it is for
Reveal nothing through an error
A stack trace or a database error is replaced by a generic page. It is on by default.
Spot sensitive data
Bank cards, IBANs, national identifiers, API keys, private keys and long lists of e-mail addresses: logged, masked or blocked as you choose.
Logs without secrets
The values of sensitive fields (password, token, card...) are replaced by *** before being recorded.
How the response is checked
Response inspection is on by default; sensitive-data detection is chosen site by site.
The origin answers first
Your server handles the request normally; ToutWAF receives its response.
Detectors read the response
Up to 1 MiB of the response by default, looking for errors, secrets, personal data and signs of a webshell or defacement.
The action you chose
Log, mask (default) or block. The visitor receives the cleaned response, or a 502 error if you block.
What is detected
Gratuito
Sensitive-data detection (DLP) is off by default; you switch it on per site and choose the types.
- Bank cards of 13 to 19 digits validated by the Luhn algorithm, and IBANs validated by their check digits.
- National identifiers of a known shape, API keys and secrets, private key blocks.
- More than 25 e-mail addresses in one response (adjustable threshold): a leaking list.
- The types detected by default are card, IBAN, national identifier, e-mail, API key and private key.
Errors and banners
Gratuito
Two protections that are on by default.
- Error masking: a stack trace, or a database error returned with a 500 to 504 code, is replaced by a generic page.
- The Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version and X-Generator banners are removed from the response.
Dangerous outputs
Gratuito
Signs of a compromise already under way.
- Webshell output (on by default), directory listings, source code and source maps.
- Defacement, from keywords you set (off by default).
- A maximum response size, if you want one (unlimited by default).
Logs without passwords
Gratuito
Events do not contain the secrets your visitors typed.
- Fields whose name is on the list (password, token, authorization, API key, card, cvv, IBAN...) are replaced by *** in the address, a form, a JSON body and a rule's excerpt.
- You add your own field names in Reports and compliance; they also apply when reading events already recorded.
- Payload capture can be switched off, and log minimisation can also drop the query string, user agent and referrer.
- Your API's responses are also classified by type of sensitive data for the API inventory, without blocking anything.
What is not done, or not proven
We prefer to say it plainly.
- Custom patterns (your own regular expressions) are not supported: the card was removed and the API refuses them. The mail gateway, under licence, does accept your own words and phrases.
- Inspection covers the first 1 MiB of a response by default; the rest is not read.
- A detection remains a detection: a false positive is possible (a number that looks like a card). Start by logging before masking or blocking.
- A field name you add also masks events already recorded when they are read, but the stored copy is not rewritten, nor are backups already made.
Use cases
An application that shows error traces
The visitor sees a generic page, your logs keep the trace so you can fix it.
An export that leaks cards
You log first, check the cases, then move to masking.
Passwords in the logs
Sensitive fields are masked before being recorded, including those you name yourself.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiciónGratuito Incluido en todas las ofertas, también en las dos gratuitas (Free y Free +)Pro y superiores Ofertas de pago: visible en la consola, bloqueada sin licencia. Desde Pro, salvo que se indique Agency o Enterprise
- Enmascaramiento de errores: una traza de pila o un error de base de datos nunca llega al visitanteGratuito
- Banners Server y X-Powered-By eliminadosGratuito
- Detección de fugas: tarjetas de pago (Luhn), IBAN, identificadores nacionales, claves de API, claves privadas, listas masivas de correosGratuito
- Registrar, enmascarar o bloquear los datos sensibles en las respuestasGratuito
- Salida de webshell, desfiguración, listados de directorios y mapas de código fuente detectadosGratuito
- Eventos y registros: contraseñas, tokens y números de tarjeta enmascaradosGratuito
- Campos que enmascarar por su nombre: el valor se sustituye por *** al recibir el evento, en la dirección, un formulario o un cuerpo JSONGratuito
- Límite de tamaño de las respuestasGratuito
Volver al valor por defecto de una opción avanzada siempre es posible. Lo que ocurre al final de una licencia de pago se describe en las preguntas frecuentes de precios: 48 horas de gracia, 48 horas de solo lectura y después la protección WAF se desactiva hasta la renovación.
Precios Read the documentation
Ponga un escudo delante de sus aplicaciones hoy mismo
Instálelo en su propio servidor, o escríbanos para hablar de licencias.