Break nothing at the start
A new site starts in detection mode: every request is inspected and recorded, nothing is blocked. Events say what would have been done.
Valse positieven en detectiemodus
Observe first, block later: a new site only records, a report says what would have been blocked, each false positive becomes the narrowest possible exception, and you can simulate, roll out gradually and roll back.
Where to find it in the console : Console: Sites, then the Protection tab of the site (detection report, switch to blocking); Events (“This is a false positive”); False positives (analysis and suggestions); Exceptions.
What it is for
Understand every match
Each event shows the rule, the location (parameter, header…), the matched fragment and a plain-language explanation: what, where, why, what to do.
Fix it narrowly
“This is a false positive” proposes the narrowest exception first, with an expiry and a preview of its effect, instead of weakening the whole policy.
Always keep the way back
Switching to blocking is one click and is undone in one click: back to detection, or back to the previous policy version.
From observing to blocking
The recommended path: observe, review, simulate, switch, watch, keep the rollback ready.
1. Observe
Detection for the period you chose (7 days by default) to cover weekly cycles: batch jobs, campaigns, month-end screens.
2. Read the report
The detection report gives the volume, the share of traffic that would still be allowed, the attack families, the few rules behind most false positives, and proposed exceptions.
3. Handle the false positives
The False positives page groups would-be blocks by rule and location; accept a suggestion, dismiss it, or flag events yourself.
4. Simulate
Replay stored traffic against the policy you plan to run: newly blocked, newly allowed, the rules behind them. An exception is settled before you switch.
5. Switch to blocking
A button in the Protection tab of the site, or the command line. A gradual rollout exists: a share of the nodes, or a share of the requests.
6. Watch and roll back
Watch the blocked rate, the 4xx rate and tickets quoting an incident ID. Back to detection in one click, or back to the previous policy version.
Three exception scopes
The dialog proposes the narrowest first.
- The narrowest: this rule, this path and the offending parameter only.
- This path: this rule on every parameter under the same directory.
- The whole rule: this rule everywhere on the site (riskier).
- An expiry (30 days by default), a reason, and a preview: how many events the exception would cover, from how many addresses, at what risk level.
Other ways to fix it, in this order
Prefer them in this order.
- An exception, the narrowest.
- A per-rule or per-path mode: “detect” instead of “block” for one rule on one path.
- A lower paranoia level for a path.
- Fix the application (for example do not echo SQL-looking text into parameters).
- Raise the threshold or lower the scores: last resort, it weakens everything.
What is not done, or not proven
We prefer to say it plainly.
- Suggestions are only proposals: nothing is ever applied automatically.
- The report and the false-positive estimate rest on your own traffic: with few days observed or little traffic the report may be incomplete, and the console says so.
- Simulation replays stored events: it is limited by the number of requests asked for (2,000 by default) and by how long events are kept.
- An exception weakens protection for what it covers: prefer the narrowest, with an expiry. We publish no measurement of false-positive rates.
Use cases
An existing site to protect
You put it in detection mode, let a week of real traffic go through, then read the report before blocking.
An internal search box
Customers type “select your size from the list”: an exception limited to that search parameter, with an expiry, settles it.
One noisy rule on one path
You set that rule to detect on that path while the application is fixed, without touching the rest.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditieGratis Inbegrepen in alle aanbiedingen, ook in de twee gratis (Free en Free +)Pro en hoger Betaalde aanbiedingen: zichtbaar in de console, vergrendeld zonder licentie. Vanaf Pro, tenzij Agency of Enterprise staat vermeld
Regels, beleid en uitrol
- Valse positieven: van gebeurtenis naar de smalste uitzondering met één klik, met uitleg in gewone taalGratis
- Simulatie: eerder verkeer afspelen tegen een conceptbeleidGratis
- Detectierapport aan het einde van de observatieperiode, met voorgestelde uitzonderingenGratis
- Geleidelijke uitrol: een deel van de nodes, een deel van de verzoeken of één regelGratis
- Fijnmazige uitzonderingen per regel, parameter, pad en adres, met vervaldatum en voorbeeld van de impactGratis
- Regeltests die in CI draaien, met JUnit-uitvoerGratis
Automatische regels
- Geschat percentage valse positieven per regelgroep en de indicator ‘Klaar om te blokkeren’Pro en hoger
Terugkeren naar de standaardwaarde van een geavanceerde optie is altijd mogelijk. Wat er aan het einde van een betaalde licentie gebeurt, staat in de veelgestelde vragen over de prijzen: 48 uur coulance, 48 uur alleen-lezen, daarna staat de WAF-bescherming uit tot de verlenging.
Prijzen Read the documentation
Zet vandaag nog een schild voor uw applicaties
Installeer het op uw eigen server, of neem contact met ons op om over licenties te praten.