# WAF and bot management

> Filter hostile traffic at the edge with a firewall that blocks known attack patterns, and challenge suspicious clients instead of blocking them so real users still get through.

A web application firewall inspects each request and drops the ones that match attack rules, before they cost your servers any work.

## Use it when

- Bots or scrapers make up a large share of traffic, and the app servers burn CPU on them.
- You see SQL injection or path traversal probes in the logs.
- A flood starts, and you need a switch that sheds hostile traffic fast.

## How it works

A WAF applies rules such as the OWASP Core Rule Set. Its **paranoia level** runs from 1 to 4. Level 1 has few rules and rarely blocks a real user, and each level up catches more attacks and flags more real requests.

**Bot management** scores the client first. A suspicious one gets a challenge (a proof of work or a CAPTCHA) instead of a block, so a real user it misjudged can still pass. **Under attack mode**, as Cloudflare names it, challenges everyone for a while. It stops nearly all junk during a flood, and costs real users an extra step.

Example: a login form on level 4 blocks more injection probes, but a customer whose password contains `'--` may be blocked too and call support.

## What it costs

More rules mean more CPU and a little latency on every request, and a false positive is a lost customer. Start at a low level and raise it by evidence. A WAF buys time while you patch a vulnerable app and never replaces the patch.

## In Quorum

Place a WAF in front of the servers, as below.



The paranoia level is a trade: more bots blocked, more real users blocked, more CPU per request. **Under attack** is a switch on the WAF card that raises the block rate and adds latency, so use it during a flood and turn it off after. A real user the WAF blocks gets a client error, which does not spend the error budget. [Web application firewall](https://wiki.playquorum.dev/research/waf.md) unlocks the [WAF](https://wiki.playquorum.dev/components/waf.md), and [Bot management](https://wiki.playquorum.dev/research/bot-management.md) halves its false positives. The [Bot surge](https://wiki.playquorum.dev/incidents/bot-surge.md) and [DDoS](https://wiki.playquorum.dev/incidents/ddos.md) incidents are the test, and the glossary defines the [WAF](https://wiki.playquorum.dev/glossary/waf-web-application-firewall.md) and [bot management](https://wiki.playquorum.dev/glossary/bot-management.md).

Source: https://wiki.playquorum.dev/patterns/waf-and-bot-management