Delivery
WAF rules
The WAF runs a set of checks against incoming requests, covering the attack categories that show up most often against typical web origins.
How it works
- Four fixed regex rules — SQL injection, XSS, path traversal, command injection — matched against the decoded request URL
- The proxy writes a typed event with the request fingerprint and answers 403 — origin fetch is skipped entirely
- Each match lands in the Security event log as a typed row — rule, IP, domain, and time
Good to know
- This kind of detection is intentionally simple and fast — it's a first line of defense, not a replacement for origin-side input validation