# OpenWAF rules

> The 49 rules OpenWAF runs on top of OWASP CRS 4.25, by id: sensitive files, path traversal, encoding evasion, request smuggling, scanner fingerprints, probe traps and emergency patches.

The edge runs **OWASP CRS 4.25** (the `coraza-coreruleset` v4.25.0 module, on Coraza) at paranoia level 1, plus the
**49 rules** of its own listed on this page. After them come the nine [stack shields](https://developers.openwaf.dev/waf/shields/) (pseudo rule ids
1001 to 1009), which are not counted here.

Every rule here appears with its id in the security events (`rule_id`) and adds points to the request's score; the
site's [mode and level](https://developers.openwaf.dev/waf/modes-and-levels/) decide what happens. To stop one rule on a path, add a
[WAF exception](https://developers.openwaf.dev/waf/waf-exceptions/) with its id. This page lists every rule in the rule files the edge loads (counted
on 2026-10-30): it is the full set, not a selection.

## Sensitive files (10001 to 10008)

| Rule | What it matches |
|---|---|
| `10001` | Dotfiles and version-control folders: `.env`, `.git`, `.svn`, `.hg` |
| `10002` | WordPress endpoints on a site that is not WordPress |
| `10003` | Server configuration files |
| `10004` | Package manager files |
| `10005` | Container and CI files |
| `10006` | Backups and database dumps |
| `10007` | Debug and server-info endpoints |
| `10008` | `wp-config.php` |

## Path traversal (10010 to 10012)

| Rule | What it matches |
|---|---|
| `10010` | Encoded path traversal in the URI |
| `10011` | Encoded path traversal in a parameter |
| `10012` | Null bytes in a parameter |

## Encoding evasion (10020 to 10022)

| Rule | What it matches |
|---|---|
| `10020` | Double URL encoding in the path |
| `10021` | Unicode fullwidth characters used to evade other rules |
| `10022` | Overlong UTF-8 encodings |

## Request smuggling and SSRF (10032 to 10035)

| Rule | What it matches |
|---|---|
| `10032` | A WebSocket upgrade aimed at a cloud metadata endpoint |
| `10033` | `h2c` cleartext upgrade smuggling |
| `10034` | The `CONNECT` method (tunnel smuggling) |
| `10035` | A `Host` header aimed at an internal or metadata address |

## Scanner fingerprints (10041 to 10058)

One rule per scanner, matched on its known signatures: `10041` sqlmap, `10042` Nikto, `10043` Nuclei, `10044` WPScan,
`10045` dirsearch, `10046` Gobuster, `10047` Nmap, `10048` masscan, `10049` wafw00f, `10050` WhatWeb, `10051` Arjun,
`10052` Commix, `10053` w3af, `10054` skipfish, `10055` Wapiti, `10056` JoomScan, `10057` droopescan and `10058` Xray.

## Probe traps (10061 to 10072)

Paths that no real visitor of a customer site asks for, so a request for them is a probe:

| Rule | What it matches |
|---|---|
| `10061` | Cloudflare internal paths |
| `10062` | WAF administration paths |
| `10063` | .NET debug handlers |
| `10064` | Java and Spring debug endpoints |
| `10065` | `cgi-bin` paths |
| `10066` | PHP administration tools |
| `10067` | Cloud metadata paths |
| `10068` | Laravel debug endpoints |
| `10069` | Source maps and build configuration |
| `10070` | GraphQL introspection |
| `10071` | Container management endpoints |
| `10072` | Shell and terminal endpoints |

## Emergency patches

| Rule | What it matches |
|---|---|
| `10075` | PHP session injection, [PHP2Shell](https://openwaf.dev/news/php2shell-cve-2026-109618-cve-2026-109619/) (CVE-2026-109618) |

New emergency rules for actively exploited CVEs are added here and announced in the [changelog](https://developers.openwaf.dev/changelog/).