Web Application Firewall

Web Application Firewall (WAF) is expertly designed to keep your website safe and secure. It examines website service traffic from multiple dimensions to accurately identify malicious requests and filter attacks, ensuring top-class system security and stability for your data.

Product Advantages
  • Stable & Intelligent

    Enables remote disaster recovery with intelligent scheduling and prioritized access; supports DNS resolution on the cloud; deploys within seconds.

  • Application-oriented

    Defines your own application-specific protection rules to accurately block attacks and reduce misreports.

  • 360-degree Protection

    Professional security teams provide 24/7 monitoring. With its proven comprehensive protections, WAF can defend against the latest 0-day vulnerabilities.

  • Synergistic

    Supports automatic upgrade on the cloud; detects potential threats and sets up multi-dimensional defense systems in collaboration with other security services.

Application Scenarios
  • Data Leakage

  • 0-Day Vulnerabilities

  • CC Attacks

  • Web Page Tampering

Data Leakage

Data Leakage

Malicious visitors use such methods as SQL injection and webshells to intrude on website databases and steal service data or other sensitive information.


Precise Identification

Uses semantic analysis & regex to examine traffic from different dimensions for added precision in thwarting attackers.

Distortion Attack Detection

Seven ways to restore code with improved detection capabilities on distortion attacks to prevent bypass attempts.

Related Services




0-Day Vulnerabilities

0-Day Vulnerabilities

WAF provides 360-degree protection using virtual patches against attacks that may exploit 0-day vulnerabilities in third-party frameworks or plug-ins.


Swift Response

Responses to vulnerabilities (including delivering virtual patches and updating the rule library) are taken in advance of actions from specific vendors.

Lower Cost

The virtual patches produce lower cost and less impact on services than the traditional patches.

Related Services



CC Attacks

CC Attacks

If a large number of malicious CC attacks are initiated, core resources are occupied for an extended period of time, causing slow website response or service interruption.


Flexible Configuration

Allows you to flexibly set rate limiting policies by IP address or cookie, provides highly precise CC attack detection, and ensures that services remain uninterrupted.


Configures response actions and content of returned pages to suit your particular needs.

Related Services


Web Page Tampering

Web Page Tampering

Attackers leave backdoors on website servers or tamper with web page content, leaving your site defaced and potentially causing you losses.


Website Malicious Code Detection

Detects malicious codes injected into the website server, helping ensure a safe visit to the site.

Protection Against Web Page Tampering

Prevents attackers from tampering with or changing web page content, or publishing indecent information that can damage the organization's reputation.

Related Services




  • Web Attack Defense

    Detects and blocks common OWASP threats, including malicious scanners, IP addresses, and webshells.

  • CC Attack Defense

    Limits rate over interfaces and uses man-machine identification, mitigating impact of CC attacks (such as HTTP flood).

Web Attack Defense

  • Complete protection

    Detects and blocks attacks, including SQL injection, XSS, file inclusion, directory traversal, sensitive file access, command and code injections, webshells, and third-party vulnerability exploits.

  • Precise identification

    Uses semantics analysis & regex dual engines and supports common code restoration methods, reducing misreports and enhancing detection capabilities.

CC Attack Defense

  • Fine-grained flexibility

    Allows you to flexibly set rate limiting policies by IP address and cookie.

  • Returned page customization

    Enables you to address diversified needs with customizable content and types of returned pages.

  • Visualized Security

    User-friendly GUI allows you to view attack information and event logs in real-time.

  • Access Control

    Offers precise logic- and parameter-based access control policies.

Visualized Security

  • Centralized policy configuration

    On-console configuration, rapid delivery, and immediate implementation of policies

  • Traffic & event statistics

    Real-time access to information, including the number and types of security events, logs, and number of requests

Access Control

  • Variety of parameter conditions

    Sets conditions with combinations of common HTTP parameters such as IP, URL, Referer, User-Agent, and Params.

  • Rich set of logic conditions

    Blocking or allowing based on logic conditions such as "Include", "Exclude", "Equal to", "Not equal to", "Prefix is", and "Prefix is not"

Usage Guides

Provides Scalable, On-demand Computing Resources

Learn More