WAF Configuration Guide: Web Application Firewall rules and website security

WAF (Web Application Firewall) is a critical security layer protecting websites from SQL injection, XSS, file inclusion, malicious bots, and other common attacks. This guide covers WAF configuration and recommended rules.

1. How WAF Works

User requests → CDN → WAF → Web Server → App → Database
                    ↓
              Block malicious ❌
              Allow legitimate ✅

Detection Methods

Method Principle Accuracy False positives
Signature matching Known attack patterns High Low
Behavioral analysis Request behavior patterns Medium High
Rate limiting Request frequency High Medium
IP reputation Historical IP behavior Medium Medium

2. Cloudflare WAF Configuration

Security Level

Cloudflare Dashboard → Security → Settings:

  • Essentially Off: Minimal blocking
  • Low: Common attacks
  • Medium: Recommended ✅
  • High: May block legitimate traffic
  • I'm Under Attack: Emergency DDoS mode

Custom Rules

# Example 1: Block known malicious IPs
Expression:
  (ip.src eq 192.0.2.1) or (ip.src in {203.0.113.0/24})
Action: Block

# Example 2: Rate limit login page
Expression:
  (http.request.uri.path eq "/wp-login.php")
Action: Rate Limit - 10 requests per 60 seconds

Managed Rule Sets

Rule set Free Pro Description
Cloudflare Managed ✅ Basic ✅ Full OWASP Top 10 protection
OWASP Core Ruleset ❌ ✅ Fine-grained control
Known Attack Signatures ✅ ✅ Regularly updated

3. ModSecurity Configuration

Nginx Integration

# Install ModSecurity
apt install libmodsecurity3 nginx-mod-modsecurity -y

# Enable module
cat > /etc/nginx/modsecurity/modsecurity.conf << 'EOF'
SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess On
SecResponseBodyMimeType text/plain text/html text/xml application/json
EOF

# Download OWASP CRS
git clone https://github.com/coreruleset/coreruleset /etc/nginx/modsecurity/crs/

# Enable in Nginx config
server {
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf;
}

OWASP CRS Attack Coverage

Rule range Attack type
930000-930999 LFI/RFI (File inclusion)
932000-932999 RCE (Remote code execution)
942000-942999 SQL Injection
950000-950999 XSS (Cross-site scripting)

4. WAF Best Practices

Deployment Flow

1. Deploy in "Log Only" mode
       ↓
2. Observe 1-2 weeks, collect false positive data
       ↓
3. Add exception rules for legitimate requests
       ↓
4. Gradually enable blocking (low-risk rules first)
       ↓
5. Continuous monitoring and adjustment

False Positive Handling

# Cloudflare - add exception rule
# ModSecurity - exclude specific URLs
SecRule REQUEST_URI "@beginsWith /api/webhook" "id:1001,phase:1,pass,nolog,ctl:ruleEngine=Off"

5. Layered Security Architecture

Layer Protection Purpose
☁️ Edge Cloudflare WAF + DDoS Block before origin
🌐 Network Firewall + Fail2Ban Block malicious IPs
🖥️ Application ModSecurity + Code audit Application layer
📊 Data DB firewall + Encryption Data protection

16IDC Takeaway

WAF offers the best security ROI for most websites. Recommended setup:

  1. Basic: Cloudflare free WAF + proper config ($0, covers most attacks)
  2. Enhanced: Cloudflare Pro WAF + custom rules ($20/mo, for e-commerce)
  3. Self-hosted: Nginx + ModSecurity + OWASP CRS (full control)

Security isn't a one-time setup — it requires regular review and updates. Audit WAF rules quarterly based on latest threat intelligence.