Observe before blocking
A new site starts in detection mode: everything is inspected and recorded, nothing is blocked. A report shows what would have been refused before you switch to blocking.
Rules and WAF protection
Readable detectors and rules, an anomaly score, modes per site, per rule and per path, narrow exceptions, virtual patches and a progressive rollout. You observe first, block later, and can always go back.
Where to find it in the console : Protection menu: Rules, Exceptions and Policies; Analysis menu: False positives; the Protection tab of a site.
What it is for
Decisions that explain themselves
Each event says which rule reacted, where (parameter, header, body), with which score and which action. No black box: you can replay a request and see the decision.
Fix a false positive without weakening the site
An exception targets one rule, one parameter, one path and one address, with an expiry date. The rest of the protection does not change.
Change the rules without taking a risk
Simulation on past traffic, rollout to a share of the nodes or of the requests, comparable versions and rollback in one step.
How ToutWAF decides
Every request goes through the same steps. The result is a decision, recorded with its evidence.
Detectors and rules
The built-in detectors (injections, deserialization, request smuggling, uploads, protocol), the OWASP CRS and your own rules look at the request. The catalogue documents more than 300 TW- error codes.
An anomaly score
Each detection adds points according to its severity: 5 for critical, 4 for error, 3 for warning, 2 for notice. The default inbound threshold is 5: one critical detection blocks, two warnings (3 + 3) block, a single warning is only logged.
The mode decides the action
Off, detection or blocking, depending on the site, the rule, the path and the method. Some rules act on their own without going through the score, for example a fake Googlebot or an unsigned JWT.
Three modes, at every level
免费
The mode is set for the whole site, but also for one rule, a family of rules, a path or a method. A rule can also change its action: log, challenge, slow down, decoy, block or redirect.
- A new site is in detection: events carry the action that would have been taken, without it being applied.
- Paranoia levels from 1 to 4 (1 by default), per site or per path. You go up one level at a time, in detection, and read the report before blocking.
- A percentage of the requests can enforce blocking (ENFORCE_PERCENT): a canary at request level.
- If the engine fails or exceeds its time budget, the site chooses to let requests through or to refuse them (per site). Choose refuse for a payment, let through for a brochure site.
OWASP CRS and SecLang
免费
The OWASP Core Rule Set v4 is evaluated by ToutWAF's own SecLang parser and evaluator, with the plug-ins that match the technology detected on your site.
- The definitions catalogue holds about 85 sources, checked every hour, verified before use and rolled back if they fail.
- Starting templates: generic, WordPress, Laravel, Symfony, Django, Spring, Node and single-page application.
- You can target a CRS identifier or a range (for example 942100-942999) in a mode or an exception.
The complete CRS v4 was only tested on a reduced fixture.
Your own rules
免费
A readable condition language, with a visual editor and a text editor that stay in sync.
- Rule tester: replay a request against the current policy and see the decision.
- Dry run on real traffic: the rule is replayed on seven days of recorded requests, without enforcing anything.
- Rule tests that run in continuous integration, with JUnit output.
The console validator and the engine accept slightly different subsets of the language: always verify a rule with a test.
Narrow exceptions and rule overrides
免费
When a rule reacts wrongly, you work around it as narrowly as possible instead of switching it off.
- An exception covers one rule, one parameter (argument, header, cookie, JSON field or body), a path prefix and an address, with an expiry and a reason.
- From an event, the button « This is a false positive » proposes the narrowest exception and shows its effect on the recorded events before creating it.
- ToutWAF also suggests exceptions from the traffic: you accept or dismiss them.
- A rule override changes the mode or action of a rule, a tag or a family, for a path and methods. Every change is versioned, compared and audited.
Example of rule overrides, in the policy of a site
YAML
rule_overrides:
- { rule: tw-sqli-orderby-probe, mode: detect }
- { rule: "tag:attack-xss", mode: block, path_prefix: /checkout }
- { rule: "family:4xxx", action: challenge, methods: [POST] }A policy that is inherited
免费
Settings go from general to specific: global, then per organisation, per site and per path. The more specific one wins.
- Every change is a version: structured difference, history and rollback in one step.
- Four-eyes approval: a second reviewer approves a version before it goes live.
- Policy as code: export, validate, compare and apply YAML or JSON from your continuous integration.
Put a rule live without risk
The recommended path is: observe, review, simulate, switch, watch, and keep the rollback ready.
Draft
You change the policy in a draft; nothing is published.
Simulation
The policy is replayed on past traffic: requests that would be newly blocked or allowed.
Canary
A share of the nodes, a share of the requests or a single rule; you watch, then extend.
Publication and rollback
Publication is automatic and fast; if a node refuses the policy, it goes back to the last accepted version.
Virtual patches
免费
A known vulnerability is blocked at the WAF while the application waits for its fix.
- A built-in catalogue covers Log4Shell, Spring4Shell and Confluence flaws, among others, and can be switched on per site.
- Emerging Threats Open signatures are converted only when the translation is exact; they log by default.
- CISA KEV advisories are informational until a verified pattern exists: they block nothing.
Automatic rules
免费Pro 及以上
ToutWAF settles its false positives and moves from observation to blocking, with evidence you audit and undo.
- Free: the self-test of a site, the false-positive estimate per rule group, the « Ready to block » indicator and the decisions journal.
- Licence required: the Automatic profile (log, challenge, then block one rule group at a time) and the automatic exceptions, narrow and time-limited.
- Guardrails: only protocol and web-injection rules can be worked around automatically, never by switching the rule off, and everything can be undone in one click.
What is not done, or not proven
We prefer to say it plainly.
- Loading the complete CRS v4 was only tested on a reduced fixture.
- Automatic rules were exercised by tests and a local bench, not on production traffic.
- The only detection and performance figures published are in the documentation: they come from the project's own synthetic corpus, are not independent measurements and do not rank ToutWAF against any other product. This page gives none.
- A WAF reduces risk, it does not replace fixing the application: keep your code's updates and access controls.
Use cases
Take a shop live without interruption
A week of detection, the report suggests a few narrow exceptions, you switch to blocking and keep the rollback ready.
React to a known vulnerability
A virtual patch blocks the exploit while the application waits for its update.
A rich-text editor triggers a rule
An exception limited to this field, this path and thirty days settles the case without touching the rest.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
版本免费 包含在所有方案中，包括两个免费方案（Free 和 Free +）Pro 及以上 付费方案：在控制台中可见，无许可证时被锁定。从 Pro 起，另有标注 Agency 或 Enterprise 的除外
应用防护
- 按词法单元结构而非关键词列表识别 SQL 注入，支持五种数据库方言免费
- NoSQL 注入：查询、表单和 JSON 正文中的运算符与服务器端 JavaScript免费
- 跨站脚本：带上下文检测器的 HTML 分词器，覆盖 SVG、DOM 汇点和多语言载荷免费
- 命令注入与代码执行：Shell、PowerShell、解释器和语言级 eval免费
- 文件包含与路径遍历，对各种编码进行多轮解码免费
- SSRF：指向内部地址、云元数据和非常规协议的请求免费
- XXE 与 XML 实体扩展、XPath 注入免费
- 模板注入：Jinja2、Twig、Freemarker、Velocity、Thymeleaf免费
- 不安全的反序列化：Java、PHP、.NET、Python、YAML免费
- LDAP、表达式语言（OGNL、SpEL）、CRLF、开放重定向和原型污染免费
- HTTP 请求走私、严格的 RFC 9112 报文界定，以及针对 HTTP/2 滥用的限制免费
- 超过检查窗口的请求正文会被拒绝或上报，绝不会未经检查就转发免费
- 文件上传：扩展名、双重扩展名、魔数、Webshell、宏，可选 ClamAV 扫描免费
- CMS 防护：WordPress、Drupal、Joomla、PrestaShop、Magento、Nextcloud免费
- 扫描器与攻击工具（sqlmap、Nikto、Nuclei、Burp），以及通过连续 404 进行的枚举免费
- CSRF：检查 Origin 和 Referer，向表单注入令牌免费
- 会话防护：固定攻击、劫持检测、Cookie 加密免费
- 有界解析：对嵌套深度、大小和参数数量设限，正则表达式按线性时间运行免费
规则、策略与发布
- 原样加载 OWASP CRS v4，使用 ToutWAF 自研的 SecLang 解析器与求值器免费
- 偏执级别 1 到 4，可按站点或路径设置免费
- 异常评分，分别设置入站和出站阈值免费
- 可按站点、规则和路径设置关闭、检测或拦截模式，并可覆盖动作免费
- 可读的规则语言，用于编写您自己的规则免费
- 按规则、参数、路径和地址设置的精细例外，可设有效期并预览影响免费
- 针对已知漏洞（Log4Shell、Spring4Shell、Confluence 等）的虚拟补丁，可按站点开关免费
- 误报处理：从事件一键生成范围最窄的例外，并附通俗易懂的解释免费
- 模拟：将历史流量回放到草稿策略上免费
- 观察期结束时生成检测报告，并附建议的例外免费
- 渐进式发布：一部分节点、一部分请求，或单条规则免费
- 策略继承：全局、组织、站点、路径免费
- 模板：通用、WordPress、Laravel、Symfony、Django、Spring、Node、单页应用免费
- 版本管理、结构化差异比对，一步回滚免费
- 版本上线前需第二人审批（四眼原则）免费
- 策略即代码：在 CI 中导出、校验、比对并应用 YAML 或 JSON免费
- 可在 CI 中运行的规则测试，输出 JUnit 格式免费
- 自动发布：每次变更都会编译、校验并在几秒内下发到节点；若有节点拒绝则自动回滚免费
自动规则
- 站点自检：在拦截任何内容之前，先由您的数据平面评估一批普通请求免费
- 按规则组估算的误报率，以及“可以开始拦截”指示免费
- 针对站点所检测到技术的 CRS 插件免费
- 自动决策日志，附依据，可一键撤销免费
- “自动”配置：先仅记录，再挑战，最后拦截，每次推进一个规则组Pro 及以上
- 自动例外：范围窄、有时效，仅在真实流量中有充分依据时才创建Pro 及以上
- 当规则更新开始拦截普通请求时自动回滚Pro 及以上
随时都可以把高级选项恢复为默认值。付费许可证结束后会发生什么，见定价页的常见问题：48 小时宽限期、48 小时只读，之后 WAF 防护关闭，直到续订。