OpenWAF rules

The edge runs OWASP CRS 4.25 (the coraza-coreruleset v4.25.0 module, on Coraza) at paranoia level 1, plus the 49 rules of its own listed on this page. After them come the nine stack shields (pseudo rule ids 1001 to 1009), which are not counted here.

Every rule here appears with its id in the security events (rule_id) and adds points to the request's score; the site's mode and level decide what happens. To stop one rule on a path, add a WAF exception with its id. This page lists every rule in the rule files the edge loads (counted on 2026-10-30): it is the full set, not a selection.

#Sensitive files (10001 to 10008)

#Path traversal (10010 to 10012)

#Encoding evasion (10020 to 10022)

#Request smuggling and SSRF (10032 to 10035)

#Scanner fingerprints (10041 to 10058)

One rule per scanner, matched on its known signatures: 10041 sqlmap, 10042 Nikto, 10043 Nuclei, 10044 WPScan, 10045 dirsearch, 10046 Gobuster, 10047 Nmap, 10048 masscan, 10049 wafw00f, 10050 WhatWeb, 10051 Arjun, 10052 Commix, 10053 w3af, 10054 skipfish, 10055 Wapiti, 10056 JoomScan, 10057 droopescan and 10058 Xray.

#Probe traps (10061 to 10072)

Paths that no real visitor of a customer site asks for, so a request for them is a probe:

#Emergency patches

New emergency rules for actively exploited CVEs are added here and announced in the changelog.