Every request to a proxied name is inspected on OpenWAF's edge nodes in Germany and Spain before it reaches your origin. The WAF combines:
- OWASP CRS 4.25 running on Coraza, plus OpenWAF's own rules (sensitive files, path traversal, encoding evasion, request smuggling, scanner fingerprints) and emergency virtual patches for new CVEs.
- Stack shields: eight targeted protections such as SSRF, open redirects, source maps and GraphQL introspection, each one switchable per path.
- Threat-intelligence feeds that block addresses of known attackers.
- IP and country rules, rate limiting and an access gate that protects admin paths with one-time codes sent by email.
You choose per zone, or per name, how strict the WAF is and whether it blocks or only records.
Get startedstart in log-only mode, review what would be blocked, then protect.Modes and levelsactive, log-only or off, and what the low, medium and high levels mean.How a request is processedthe order in which the edge applies every check.Stack shieldsthe eight shields, their ids and what they block.Threat feedscurated lists of attacker addresses, on by default.Browser challengethe proof-of-work page that real browsers pass automatically.WAF exceptionsswitch a rule or a shield off on a path when it blocks legitimate traffic.IP and country rulesallow or block addresses, ranges and countries.Rate limitinglimit requests per IP, header, cookie or JSON field on a path.Access gateput an admin area behind one-time codes sent by email.Block pagechoose what blocked visitors see.Settings referenceevery WAF setting, its values and its default.Rule referencethe four rule kinds and their fields.Edge responses and headersstatus codes the edge answers and headers it adds or removes.Troubleshootingfalse positives, blocked WordPress logins, large uploads.
Where to find it
| Interface | Settings | Rules |
|---|---|---|
| Dashboard | Domain → Security → Firewall, Security → Rate limiting, Security → Access gate | Security → Firewall → Rules |
| CLI | zones show, zones set, ratelimit list/add/set/rm | rules list, rules add, rules rm |
| API | GET/PATCH /v1/orgs/{org}/zones/{zone}/edge | GET/POST /v1/orgs/{org}/zones/{zone}/rules, DELETE …/rules/{rule} |
| MCP | get_zone, update_settings, effective_config | list_rules, add_rule, remove_rule |
Every change is versioned: it is simulated first, needs a reason and can be reverted. See Change control. Blocked and logged requests appear in security events.