Break nothing at the start
A new site starts in detection mode: every request is inspected and recorded, nothing is blocked. Events say what would have been done.
Falsos positivos e modo de deteção
Observe first, block later: a new site only records, a report says what would have been blocked, each false positive becomes the narrowest possible exception, and you can simulate, roll out gradually and roll back.
Where to find it in the console : Console: Sites, then the Protection tab of the site (detection report, switch to blocking); Events (“This is a false positive”); False positives (analysis and suggestions); Exceptions.
What it is for
Understand every match
Each event shows the rule, the location (parameter, header…), the matched fragment and a plain-language explanation: what, where, why, what to do.
Fix it narrowly
“This is a false positive” proposes the narrowest exception first, with an expiry and a preview of its effect, instead of weakening the whole policy.
Always keep the way back
Switching to blocking is one click and is undone in one click: back to detection, or back to the previous policy version.
From observing to blocking
The recommended path: observe, review, simulate, switch, watch, keep the rollback ready.
1. Observe
Detection for the period you chose (7 days by default) to cover weekly cycles: batch jobs, campaigns, month-end screens.
2. Read the report
The detection report gives the volume, the share of traffic that would still be allowed, the attack families, the few rules behind most false positives, and proposed exceptions.
3. Handle the false positives
The False positives page groups would-be blocks by rule and location; accept a suggestion, dismiss it, or flag events yourself.
4. Simulate
Replay stored traffic against the policy you plan to run: newly blocked, newly allowed, the rules behind them. An exception is settled before you switch.
5. Switch to blocking
A button in the Protection tab of the site, or the command line. A gradual rollout exists: a share of the nodes, or a share of the requests.
6. Watch and roll back
Watch the blocked rate, the 4xx rate and tickets quoting an incident ID. Back to detection in one click, or back to the previous policy version.
Three exception scopes
The dialog proposes the narrowest first.
- The narrowest: this rule, this path and the offending parameter only.
- This path: this rule on every parameter under the same directory.
- The whole rule: this rule everywhere on the site (riskier).
- An expiry (30 days by default), a reason, and a preview: how many events the exception would cover, from how many addresses, at what risk level.
Other ways to fix it, in this order
Prefer them in this order.
- An exception, the narrowest.
- A per-rule or per-path mode: “detect” instead of “block” for one rule on one path.
- A lower paranoia level for a path.
- Fix the application (for example do not echo SQL-looking text into parameters).
- Raise the threshold or lower the scores: last resort, it weakens everything.
What is not done, or not proven
We prefer to say it plainly.
- Suggestions are only proposals: nothing is ever applied automatically.
- The report and the false-positive estimate rest on your own traffic: with few days observed or little traffic the report may be incomplete, and the console says so.
- Simulation replays stored events: it is limited by the number of requests asked for (2,000 by default) and by how long events are kept.
- An exception weakens protection for what it covers: prefer the narrowest, with an expiry. We publish no measurement of false-positive rates.
Use cases
An existing site to protect
You put it in detection mode, let a week of real traffic go through, then read the report before blocking.
An internal search box
Customers type “select your size from the list”: an exception limited to that search parameter, with an expiry, settles it.
One noisy rule on one path
You set that rule to detect on that path while the application is fixed, without touching the rest.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiçãoGratuito Incluído em todas as ofertas, incluindo as duas gratuitas (Free e Free +)Pro e superiores Ofertas pagas: visível na consola, bloqueada sem licença. A partir do Pro, salvo indicação Agency ou Enterprise
Regras, política e implementação
- Falsos positivos: do evento à exceção mais estreita com um clique, com explicação em linguagem claraGratuito
- Simulação: reproduzir o tráfego passado contra uma política em rascunhoGratuito
- Relatório de deteção no fim do período de observação, com as exceções propostasGratuito
- Implementação progressiva: uma parte dos nós, uma parte dos pedidos ou uma única regraGratuito
- Exceções precisas por regra, parâmetro, caminho e endereço, com expiração e pré-visualização do impactoGratuito
- Testes de regras executáveis na CI, com saída JUnitGratuito
Regras automáticas
- Taxa estimada de falsos positivos por grupo de regras e indicador «Pronto para bloquear»Pro e superiores
Voltar ao valor predefinido de uma opção avançada é sempre possível. O que acontece no fim de uma licença paga está descrito nas perguntas frequentes de preços: 48 horas de tolerância, 48 horas só de leitura e depois a proteção WAF é desativada até à renovação.
Coloque hoje um escudo à frente das suas aplicações
Instale-o no seu próprio servidor, ou contacte-nos para falar de licenças.