Our Web Application Firewall (WAF) helps protect your domains from bad or malicious traffic by checking every incoming request. It is powered by the OWASP Core Rule Set, a widely used collection of rules that automatically blocks common attack patterns such as SQL injection, cross-site scripting, and other suspicious payloads. All of this happens in real time, before the request can ever reach your redirect destination.
All rules are defined by the OWASP Core Rule Set. You can enable the WAF here. The WAF is available in our Business plan and up.
How does the WAF work?
- It watches incoming requests to your domains and blocks "bad" ones.
- If a request matches one of the OWASP rules, it gets blocked, before it reaches your redirect destination.
- All blocked requests show up in the analytics view, so you can see what traffic was stopped.
Enabling & overriding
- You can enable WAF at Team level, which means it applies by default to all your domains.
- If needed, you can override the default for specific domains. This lets you turn on or off the WAF per domain.
