WAF and bot management
Filter hostile traffic at the edge with a firewall that blocks known attack patterns, and challenge suspicious clients instead of blocking them so real users still get through.
A web application firewall inspects each request and drops the ones that match attack rules, before they cost your servers any work.
Use it when#
Bots or scrapers make up a large share of traffic, and the app servers burn CPU on them.
You see SQL injection or path traversal probes in the logs.
A flood starts, and you need a switch that sheds hostile traffic fast.
How it works#
A WAF applies rules such as the OWASP Core Rule Set. Its paranoia level runs from 1 to 4. Level 1 has few rules and rarely blocks a real user, and each level up catches more attacks and flags more real requests.
Bot management scores the client first. A suspicious one gets a challenge (a proof of work or a CAPTCHA) instead of a block, so a real user it misjudged can still pass. Under attack mode, as Cloudflare names it, challenges everyone for a while. It stops nearly all junk during a flood, and costs real users an extra step.
Example: a login form on level 4 blocks more injection probes, but a customer whose password contains '-- may be blocked too and call support.
What it costs#
More rules mean more CPU and a little latency on every request, and a false positive is a lost customer. Start at a low level and raise it by evidence. A WAF buys time while you patch a vulnerable app and never replaces the patch.
In Quorum#
Place a WAF in front of the servers, as below.
Drag to pan. Hold Ctrl or Cmd and scroll to zoom.
| Where | Setting | Value | Why |
|---|---|---|---|
| WAF | Paranoia level | 3 | A higher level blocks more bots but also more real users, and costs more CPU per request. |
| App Server | Instance size | medium | Medium for the app behind the WAF. |
| Database | Instance size | medium | Medium for the Database. |
Research this Design needs: Web application firewall, Web application firewall, Bot management.
The paranoia level is a trade: more bots blocked, more real users blocked, more CPU per request. Under attack is a switch on the WAF card that raises the block rate and adds latency, so use it during a flood and turn it off after. A real user the WAF blocks gets a client error, which does not spend the error budget. Web application firewall unlocks the WAF, and Bot management halves its false positives. The Bot surge and DDoS incidents are the test, and the glossary defines the WAF and bot management.