CloFix WAF Security – Key Features
Secure Your Applications. Scale with Confidence
CloFix WAF is a next-generation, AI-enhanced Web Application Firewall designed specifically for cloud-based applications. It offers enterprise-grade protection, real-time monitoring, and affordable scalability - perfect for startups, SMEs, and DevOps-driven teams.
Load Balancer
⚖️ CloFix Load Balancer
Intelligent traffic distribution with backend information hiding, health checks, and 99.99% availability SLA
Key Benefits
- Backend Information Hiding: Automatically removes 30+ sensitive headers (Server, X-Powered-By, X-Backend-Server, X-Upstream, Via, X-Real-IP) — prevents attackers from discovering internal infrastructure
- Response Body URL Rewriting: Automatically rewrites backend URLs in HTML, JSON, and XML responses to show only frontend domain — http://clofix.com/page → https://demo.clofix.com/page
- Real-time Backend Alerts: Automatic notifications when backends go down or recover — supports Slack, Email, Webhook, and Telegram with detailed failure information
- 99.99% Availability SLA: Enterprise-grade reliability with automatic failover and connection draining — zero-downtime deployments
- <1ms Latency Overhead: Ultra-low latency with zero-copy forwarding and connection pooling — no measurable performance impact
- 5+ Load Balancing Algorithms: Round Robin (sequential distribution), Least Connections (send to server with fewest active connections), IP Hash (client IP to same backend), Weighted (capacity-based), Random — choose per workload
- Active Health Checks: Configurable HTTP/HTTPS health checks with custom path, interval (default 10s), timeout (default 3s), and expected status code (default 200) — automatic backend removal on failure
- Passive Health Monitoring: Track real traffic failures (max_fails default 3, fail_timeout 30s) — mark backends unhealthy without extra probe traffic
- Session Persistence (Sticky Sessions): Cookie-based stickiness with configurable cookie name (default clofix_backend) — ensures user sessions stay on the same backend server
- Backend Weight Configuration: Assign weights to servers based on capacity — weight=10 for powerful instances, weight=1 for smaller ones
- Backup Servers: Designate backup backends (backup=true) — used only when all primary servers fail, with separate max_fails/fail_timeout settings
- Connection Draining: Gracefully remove backends from rotation — existing connections complete before server shutdown, zero dropped requests during deployments
- Max Retries & Timeout: Configurable retry logic (max_retries default 3, retry_timeout 5s) — automatically retry failed requests on healthy backends
- Concurrent Connection Limits: max_conns per backend prevents resource exhaustion during traffic spikes — unlimited by default
- HTTP/2 & HTTP/3 Support: Full support for modern HTTP protocols with multiplexing and improved performance
- SSL/TLS Termination: Offload SSL at load balancer with configurable TLSv1.2 and TLSv1.3 protocols — automatic certificate management available
- Client IP Preservation: Original client IP preserved through X-Forwarded-For and PROXY protocol — backends always know real client address
- Header Sanitization: Removes 25+ debugging and server identification headers from responses before reaching clients
- Real-time Metrics: Prometheus-compatible metrics for each backend — request rate, error rate, active connections, health status
- Admin API: REST API for dynamic backend management — add, remove, enable, disable, or rebalance backends without reload
- Zero-Downtime Reloads: Update load balancer configuration without dropping connections — graceful reload with connection draining
- Active-Active Clustering: Multiple load balancer instances with shared state — no single point of failure
- WebSocket Support: Native WebSocket protocol upgrade with connection persistence across backend pools — perfect for real-time applications
- gRPC Load Balancing: Full gRPC support with HTTP/2 multiplexing and health checking protocol integration
- Layer 4 (TCP/UDP) Load Balancing: Transparent TCP/UDP proxy for databases, message queues, and legacy applications — no HTTP required
- IPv4/IPv6 Dual Stack: Listen on both IPv4 and IPv6, connect to backends over IPv4 or IPv6 with configurable preference
- Gzip Compression: Automatic response compression to reduce bandwidth and improve load times
- Custom Error Pages: Serve branded error pages when backends are unavailable — maintain user experience during outages
- Maintenance Mode: Temporarily block traffic to specific backends or routes with custom responses — zero-downtime maintenance windows
- Blue/Green Deployments: Route traffic between backend versions — gradual rollout with instant rollback capability
- Canary Deployments: Send percentage of traffic to new version, monitor error rates, automatically rollback on failure
- Geolocation-Based Routing: Route users to nearest backend based on country or region — reduces latency and improves user experience
- PROXY Protocol Support: Preserve original client IP when using proxy protocols with backend servers that support PROXY v1/v2
💡 How it works: CloFix Load Balancer sits between clients and backend servers, intelligently distributing traffic based on configurable algorithms. Health checks run continuously — unhealthy backends are automatically removed from rotation based on max_fails (default 3) and fail_timeout (default 30s). Backend information hiding automatically strips 30+ sensitive headers from responses, including Server, X-Powered-By, X-Backend-Server, and Via headers. Response body URL rewriting converts internal backend URLs to frontend domain in HTML, JSON, and XML content. Real-time notifications alert via webhook when backends go down or recover. Session persistence (sticky sessions) ensures users stay on the same backend via cookies. Configuration supports weight-based distribution for uneven backend capacities, backup servers for failover, and connection pooling for optimal performance. All this runs with less than 1ms latency overhead.
📖 Documentation: CloFix Load Balancer Guide — Backend configuration, load balancing algorithms, health checks, and security hardening
Scripting Engine
🦀 CloFix WASM Engine
High-performance WebAssembly module execution engine with memory isolation, timeout protection, and intelligent request processing for custom WAF rules
Key Benefits
- Memory Isolation & Security: Each WASM module runs in its own sandbox with configurable memory limits (default 64MB) — prevents memory corruption and protects host system from malicious modules
- Execution Timeout Protection: Configurable timeouts per module (default 100ms) — automatically terminates runaway modules, prevents DoS attacks, and ensures predictable WAF performance
- Instance Pooling: Pre-warmed module instances with configurable pool size (default 8) — eliminates cold starts, reduces latency by 70-90%, and handles sudden traffic spikes
- Host Function API (40+ Functions): Rich request/response manipulation, geoIP lookup, threat intelligence, crypto utilities, rate limiting, and string operations — build complex WAF logic without writing custom C extensions
- Zero-Copy Memory Access: Direct memory mapping between host and WASM — minimizes data copying overhead, achieves sub-millisecond request processing latency
- Multiple Language Support: Write modules in 8+ languages — TinyGo (strongly recommended), Rust (wasm32-wasi), C/C++ (wasi-sdk), AssemblyScript, Zig, and more — use your existing skills
- Automatic Module Reload: Hot reload modules without restarting the WAF — zero-downtime rule updates, instant security policy changes, and A/B testing of new rules
- Comprehensive Request Data: 80+ request fields available — headers, cookies, geo location (country/city/ASN), TLS fingerprint (JA3/JA4), bot detection scores, anomaly scores, and client reputation
- Built-in Rate Limiting: Token bucket algorithm with configurable limits per key — protect APIs and endpoints without external Redis or database dependencies
- Threat Intelligence Integration: Real-time IP reputation, Tor exit node detection, VPN/proxy detection, datacenter IP identification — block malicious traffic before it reaches your applications
- Geolocation Processing: Country, city, region, postal code, latitude/longitude, ASN, ISP — implement geo-fencing, localize responses, or route traffic based on client location
- Response Manipulation: Add/remove headers, set cookies with secure/httpOnly flags, redirect requests, customize status codes — modify responses without changing backend code
- Advanced String Utilities: Regex matching, substring search, case conversion, URL encoding/decoding — complex pattern matching without performance penalties
- Crypto Operations: SHA256 hashing, Base64 encoding/decoding — verify signatures, decode tokens, or transform data without external libraries
- JSON Processing: Parse and manipulate JSON request/response bodies — inspect form data, validate JSON schemas, or extract specific fields for analysis
- Real-time Statistics: Per-module metrics — execution count, error rate, timeout rate, block rate, average latency — identify performance bottlenecks and security threats
- Timeline Analytics: Hourly request/block tracking — visualize traffic patterns, detect attack spikes, and monitor rule effectiveness over time
- Top Blocked IPs: Automatic tracking of most frequently blocked IPs — identify attackers, implement additional protections, or report to threat feeds
- Structured JSON Logging: Color-coded console output with severity levels (INFO, WARN, ERROR, CRITICAL) — integrate with your existing logging pipeline
- Validator Tool Included: Comprehensive WASM validator checks — header validation, import allowlist/blocklist, required exports verification, memory limit checks, and binary pattern analysis
- Compiler Detection: Automatic detection of 8+ compilers — identifies browser-only WASM (rejected) vs WAF-compatible modules (accepted) with clear error messages and remediation steps
- Dangerous Import Blocking: Hard blocks filesystem access (path_open), network I/O (sock_recv/send), process manipulation (proc_raise), and blocking operations (poll_oneoff) — prevents malicious modules
- Configurable Validation Modes: Strict (fail on any ERROR), Standard (fail only on CRITICAL), Permissive (report only) — adapt to your security requirements
- ABI Standard Compliance: process_request(ptr, len) → packed uint64 (ptr<<32|len) or two-return convention — TinyGo and Rust compatible out of the box
- JSON Output Support: Machine-readable validation results for CI/CD pipelines — automate module testing before deployment
- Fail-open Architecture: Configurable fail-open mode — if a module crashes or times out, requests continue processing (default) or can be configured to fail-closed for high-security environments
- Concurrent Request Handling: Thread-safe design with sync.Pool and atomic counters — handles thousands of concurrent requests without lock contention
- WASI Preview1 Support: Full WASI system interface implementation — modules can use random_get, clock_time_get, fd_write for logging, and memory_grow for dynamic allocation
- Module Preloading: Load all modules from directory at startup — warm all pools, verify module integrity, and ensure zero errors before accepting traffic
- Memory Limit Enforcement: Hard limits per module (configurable up to 64MB) — prevents memory exhaustion attacks, protects other modules, and ensures fair resource allocation
- Per-Request Context: Isolated request context passed to host functions — no cross-request contamination, thread-safe header/body access, and deterministic processing
- Binary Pattern Detection: Scans for embedded PE/MZ/ELF/Mach-O headers, x86 NOP sleds, and nested WASM modules — detects injection attacks and malicious payloads
- SHA256 Integrity Checks: Automatic hashing of all loaded modules — audit which version is running, detect unauthorized changes, and ensure supply chain security
- Multi-domain Support: Different module chains per domain — per-customer WAF rules, white-label deployments, or testing new rules on specific domains
- Session Persistence: WASM modules can read/set session cookies and values — implement custom session validation, user tracking, or fraud detection logic
- Bot Detection Scores: Pre-calculated bot scores based on User-Agent, header completeness, and behavioral patterns — module can block, challenge, or log suspicious requests
- Anomaly Scoring: Request anomaly detection based on method, path length, query parameters, and header patterns — flag unusual requests for additional inspection
- Risk Scoring Framework: Weighted risk scoring (INFO=1, WARN=5, ERROR=20, CRITICAL=35) with 0-100 scale — automated pass/fail decisions with CLEAN/LOW/MEDIUM/HIGH/CRITICAL labels
💡 How it works: CloFix WASM Engine embeds the wazero WebAssembly runtime (zero dependencies, pure Go). When a request arrives, the engine builds a rich WASMRequest structure with 80+ fields including HTTP details, geo location, threat intel, and bot scores. The engine acquires a pre-warmed module instance from the pool, calls wasm_alloc to allocate memory for the request JSON, writes the data to linear memory, then calls process_request. The module processes the request using 40+ host functions (get_header, set_cookie, rate_limit, is_tor, etc.), returns a decision (allow/block/challenge/redirect) with optional headers/cookies. The engine parses the response, applies any modifications (headers, cookies, redirects), and returns the final decision to the proxy layer. Execution timeouts (default 100ms) prevent runaway modules — if a module times out, the engine marks it as failed and continues to the next module. Instance pooling eliminates cold starts — modules are loaded once and reused across requests. All host functions are pre-registered and validated — modules can only access safe, WAF-specific operations. The included validator tool checks modules before loading — verifies required exports (process_request, wasm_alloc), validates imports (only env/wasi_snapshot_preview1), enforces memory limits, scans for dangerous patterns, and detects incompatible compilers (Rust wasm-bindgen, Go syscall/js). This ensures only safe, compatible modules run in production.
📖 Documentation: CloFix WASM Engine Guide — Module development, host API reference, validator usage, deployment patterns, and performance tuning
📊 Performance Metrics:
- Median latency: 85µs (microseconds) per module
- P99 latency: 420µs including JSON marshaling
- Memory overhead: ~2MB per module + pool instances
- Concurrent requests: 10,000+ without degradation
- Module cold start: <50ms including compilation
- Warm instance reuse: <10µs to acquire from pool
🔒 Security Hardening:
- No filesystem access — modules cannot read/write files
- No network access — modules cannot make external requests
- No arbitrary syscalls — only pre-approved host functions
- Memory sandboxing — each module has isolated linear memory
- Execution timeouts — modules cannot run indefinitely
- Memory limits — configurable up to 64MB prevents DoS
- Import allowlist — only env and wasi_snapshot_preview1 allowed
- Binary scanning — detects embedded malicious payloads
- Compiler detection — rejects browser-only WASM modules
🚀 Deployment Examples:
- Rate Limiting API: WASM module implements custom rate limiting per user, API key, or endpoint with token bucket algorithm
- Bot Mitigation: Module checks bot scores, JA3 fingerprints, and behavior patterns — challenges or blocks headless browsers and scrapers
- Geo-Fencing: Module blocks requests from restricted countries based on geoIP lookup — protects content licensing agreements
- Custom Authentication: Module validates JWT tokens, checks session cookies, or calls internal auth service via cache — implements custom auth logic
- Request Validation: Module validates JSON schema, checks parameter types, and enforces business rules before forwarding to backend
- Response Transformation: Module modifies response bodies, adds security headers, or removes sensitive data before sending to client
- A/B Testing: Module routes percentage of traffic to different backends based on user ID or cookie — test new features safely
- WAF Rule Engine: Module implements custom WAF rules — SQL injection detection, XSS filtering, path traversal prevention
📜 CloFix JavaScript (clofix) Engine
Server-side JavaScript WAF scripting with full HTTP pipeline control and shared in-memory state
Key Benefits
- Entry Point: Every script must export `function clofix(request)` that returns an action object — first non-allow action wins pipeline execution
- Request Object: Full access to `request.ip`, `request.method`, `request.path`, `request.url`, `request.query`, `request.headers`, `request.body`, `request.cookies`, `request.user_agent`, `request.is_tor`, `request.timestamp`
- Shared Dictionaries: Persistent cross-request state via `sharedDict("name")` with `get()`, `set()`, `incr()`, `delete()` methods — perfect for rate limiting and bot tracking
- Pattern Extraction: System auto-extracts patterns from ALL JavaScript files for fast matching — strings and regex patterns become detection signatures
- Action Types: Return `{ action: "allow" }`, `{ action: "block", reason: "..." }`, `{ action: "rate_limit" }`, or `{ action: "redirect", redirect_to: "..." }`
- Structured Logging: `log.info()`, `log.warn()`, `log.error()` for general logs; `log.attack({ rule_name, category, confidence, payload })` for attack detection
- Execution Limits: 2 second wall-clock timeout per script, 32MB memory limit, 10MB max file size — prevents runaway scripts from impacting WAF throughput
- SQL Injection Detection: Pattern-based detection for UNION SELECT, INSERT INTO, DROP TABLE, time-based attacks, and boolean blind injection
- XSS Protection: Script tag injection, event handlers (onerror, onload), JavaScript protocol, and DOM-based XSS pattern detection
- Command Injection: Unix/Linux command chaining (`;`, `|`, `&&`, `` ` ``), Windows cmd.exe patterns, and dangerous command execution detection
- Path Traversal/LFI: `../`, `..\`, URL-encoded traversal, sensitive file access (`/etc/passwd`, `/windows/win.ini`) blocking
- SSRF Protection: Block internal IP ranges (127.0.0.1, 169.254.x.x, 10.x.x.x, 192.168.x.x) and cloud metadata endpoints (169.254.169.254)
- Rate Limiting: Per-IP sliding window with timestamp array storage, burst detection, and graduated blocking (60s, 600s, 86400s escalation)
- GeoIP Blocking: Country-level blocking using `request.country` (requires GeoIP implementation)
- Bot Detection: User-Agent patterns (sqlmap, nikto, wpscan), headless browser detection, and missing UA challenge
- Brute Force Protection: Login path monitoring with 5-attempt windows, 30-minute bans after threshold exceeded
- DDoS Shield: Two-tier protection — burst detection (30 req/2s) and sustained rate (200 req/min) with escalating bans (60s → 600s → 86400s)
- CSRF Protection: Origin header validation for POST/PUT/DELETE/PATCH methods with configurable allowed origins and exempt paths
- API Key Authentication: Validate `X-API-Key` header or `api_key` query parameter against pre-configured key store
- File Type Filtering: Block dangerous extensions (.php, .asp, .jsp, .exe, .sh, .py) before they reach backend
- Maintenance Mode: Temporary blocking with IP allowlisting and health check exemptions
- Smart Redirects: URL rewriting with exact and prefix-based 301/302 redirects
- Honeypot Traps: Special URLs that ban any visiting IP (except whitelisted search engine bots) for 24 hours
- Password Protect URLs: Simple token-based authentication for staging/preview environments
- Tor/VPN Blocking: Native `request.is_tor` detection for blocking Tor exit nodes
💡 How it works: JavaScript scripts execute in isolated V8 isolates with a 2-second timeout. Files execute in alphabetical order — use numeric prefixes like `01_rate_limit.js`, `02_bot_detect.js` to control priority. The first script returning a non-allow action stops pipeline execution. Shared dictionaries (`sharedDict("name")`) provide persistent cross-request storage with TTL support. Pattern extraction automatically scans all JavaScript files for strings and regex patterns, creating fast-matching signatures checked against every request. The system is configured via `js_blocker` block in domain config with `js_dir`, `execution_timeout`, `block_threshold`, and `scan_interval` settings.
📖 Official Documentation: CloFix JavaScript Scripting Guide — Complete API reference with SQL injection, XSS, rate limiting, DDoS protection, and more examples
⚙️ OWASP CRS Core Rule Set
Industry-standard web attack detection with 25 rule files, 4 paranoia levels, and anomaly scoring
Key Benefits
- 25 Rule Files: Complete OWASP CRS v4 rule set covering initialization, IP reputation, protocol enforcement, LFI, RFI, RCE, SQLi, XSS, NoSQL, and response leakage detection
- Paranoia Levels 1-4: Level 1 (minimal false positives, general production) to Level 4 (maximum security, high-risk apps) — adjustable per domain or globally
- Anomaly Scoring: Threshold-based blocking with configurable scores (default 5 inbound, 4 outbound). CRITICAL=5pts, ERROR=4pts, WARNING=3pts, NOTICE=2pts, INFO=1pt
- CloFixRule Directive: CRS-style custom rules with variables (ARGS, REQUEST_HEADERS, BODY), operators (@rx, @contains, @streq), and transformations (t:lowercase, t:urlDecode, t:htmlEntityDecode)
- SQL Injection (942xxx): Union-based, time-based sleep/benchmark, boolean blind, error-based, stacked queries — 100+ rules covering all evasion techniques
- Cross-Site Scripting (941xxx): Script tags, event handlers, JavaScript protocol, SVG/iframe injection, and reflected/stored/DOM-based XSS detection
- Local/Remote File Inclusion (930xxx, 931xxx): Path traversal (`../`, `..\`), sensitive file access (/etc/passwd, /windows/win.ini), PHP wrappers (php://), remote includes (http://, ftp://)
- Command Injection (932xxx): Unix command chaining (`;`, `|`, `&&`, `` ` ``), Windows cmd.exe, PowerShell, and dangerous command execution detection
- SSRF Protection (933xxx): Internal IP ranges (127.0.0.1, 10.x.x.x, 172.16-31.x.x, 192.168.x.x), cloud metadata endpoints (169.254.169.254, metadata.google.internal)
- NoSQL Injection (970xxx): MongoDB operators (`$ne`, `$gt`, `$or`, `$where`, `$regex`), JavaScript injection in NoSQL queries
- Bot Detection (910xxx): Malicious user agents (sqlmap, nikto, wpscan, gobuster), headless browsers (Puppeteer, Playwright, Selenium), and security scanners
- Protocol Enforcement (920xxx): HTTP method restrictions, protocol violations, header injection, Host header attacks, malformed request detection
- IP Reputation (910xxx): Tor exit nodes, VPN/proxy detection, known malicious IPs, and blacklist integration with hourly updates
- DoS Protection (912xxx): Rate-based DoS detection with configurable thresholds and blocking actions
- Response Inspection (950xxx, 951xxx): Data leakage detection (credit cards, SSNs, API keys), SQL error messages, and information disclosure prevention
- Intelligent Bypass System: Bypass by rule ID, tag (`attack-sqli`, `paranoia-level/3`), phase (1-4), path (`/health`, `/api/public/*`), or IP (`127.0.0.1`, `192.168.1.*`)
- Transformations Chain: Multiple transformations applied in sequence — lowercase, URL decode, HTML entity decode, remove nulls, compress whitespace — defeating evasion techniques
- Automatic Rule Updates: CRS rules update from official OWASP repository every 6 hours — zero-day protection within hours of disclosure
- Coraza WAF Engine: Modern Go-based ModSecurity-compatible engine with Hyperscan regex — 5-10x faster than traditional ModSecurity
- Multi-Phase Inspection: Phase 1 (request headers), Phase 2 (request body), Phase 3 (response headers), Phase 4 (response body) — comprehensive coverage
- Virtual Patching: Create custom CloFixRule directives to patch vulnerable applications without code changes — deploy within minutes of vulnerability disclosure
- Compliance Mode: Pre-configured rule sets for PCI DSS 4.0, HIPAA, and GDPR with audit logging and reporting
- False Positive Analysis: Dashboard showing most triggered rules, false positive rate, and suggested exclusions based on traffic patterns
- Rule Testing: Built-in regression testing with attack payload simulation to validate rule effectiveness before production deployment
💡 How it works: CloFix CRS processes requests through 4 phases with 25 rule files loaded in OWASP order. The anomaly scoring system aggregates weighted points from matched rules — reaching the configured threshold triggers blocking. Paranoia levels allow gradual tuning from minimal false positives (Level 1) to maximum security (Level 4). The intelligent bypass system supports rule ID, tag, phase, path, and IP bypasses. All rule processing uses the Coraza engine with Hyperscan regex, handling 100,000+ requests/second. Configuration uses `CloFixRule` directives with variables, operators, transformations, and actions. Rules automatically update from the OWASP CRS repository every 6 hours.
📖 Official Documentation: CloFix OWASP CRS Guide — Complete reference with 25 rule files, paranoia levels, anomaly scoring, and bypass configuration
🔧 CloFix Lua Scripting Engine
Embedded Lua 5.4 with clofix_main entry point, threat scoring, and shared dictionaries
Key Benefits
- Entry Point: Every script must define `function clofix_main(request)` returning an action table — `{ action = "allow" }`, `{ action = "block", status = 403, message = "..." }`, or `{ action = "rate_limit", rule_name = "RL_001" }`
- Request Object: Full read-only access to `request.ip`, `request.method`, `request.path`, `request.uri`, `request.headers`, `request.body`, `request.json_body`, `request.cookies`, `request.query`, `request.form_data`, `request.ja3`, `request.ja4`, `request.is_tor`, `request.is_vpn`, `request.bot_score`, `request.ip_reputation`, `request.country`, `request.asn`
- Shared Dictionaries: Persistent state across requests via `clofix.shared.ddos_attack` with `get()`, `set(key, value, ttl?)`, `incr()`, `delete()` — perfect for rate limiting, bot tracking, and DDoS protection
- Payload Normalization: `clofix.normalize_payload(s)` — multi-pass URL decode, HTML decode, lowercase, and whitespace collapse for injection detection
- Threat Intelligence: `clofix.is_tor()`, `clofix.is_vpn()`, `clofix.ip_reputation()` returns "clean"/"suspicious"/"malicious", `clofix.get_bot_score()` (0-100), `clofix.get_ja3()` fingerprint
- Rate Limiting API: `clofix.rate_limit(key, limit, window_secs)` returns (count, exceeded), `clofix.rate_limit_ip(limit, window)`, `clofix.rate_limit_endpoint(limit, window)` for per-IP-path limits
- Structured Attack Logging: `clofix.log_attack(rule, type, payload?)` auto-includes IP, country, UA, method, URI — essential for SIEM integration
- Action Types: `allow`, `block` (403), `challenge` (429 CAPTCHA), `rate_limit` (429), `log_only`, `redirect` (with redirect_to field), `captcha`
- Threat Scoring Engine: Return `{ score = 85 }` instead of action — engine applies thresholds (<20 allow, 20-49 log_only, 50-79 challenge, ≥80 block)
- utils.* Helpers: `utils.contains()`, `utils.starts_with()`, `utils.ends_with()`, `utils.split()`, `utils.to_lower()`, `utils.json_encode()`, `utils.json_decode()`, `utils.url_encode()`, `utils.base64_encode()`, `utils.now()`
- SQL Injection Detection: Patterns for UNION SELECT, INSERT INTO, DROP TABLE, OR 1=1, SLEEP(), BENCHMARK(), information_schema — with payload normalization
- XSS Protection: Script tags, JavaScript protocol, event handlers (onerror, onload), SVG/iframe injection, and DOM-based XSS patterns
- Command Injection: Unix command chaining (`;`, `|`, `&&`, `` ` ``), Windows cmd.exe, PowerShell, and dangerous commands (wget, curl, nc, python -c)
- Path Traversal/LFI: `../`, `..\`, URL-encoded traversal (`%2e%2e%2f`), sensitive file access (`/etc/passwd`, `boot.ini`, `php://`, `file://`)
- SSRF Protection: Internal IP ranges (127.0.0.1, 10.x.x.x, 172.16-31.x.x, 192.168.x.x), cloud metadata (169.254.169.254, metadata.google.internal)
- Brute Force Protection: Login path detection with shared dictionary counters, 10 attempts/5min window, 30-minute ban, and configurable thresholds
- DDoS Shield: Two-tier protection — burst detection (30 req/2s) and sustained rate (200 req/min) with escalating bans (60s → 600s → 86400s) using shared dictionaries
- Bot Detection: `request.is_bot`, `request.is_headless`, `request.bot_score`, UA pattern matching (python, curl, wget, sqlmap, nikto, gobuster), and missing UA blocking
- GeoIP Blocking: `request.country` ISO-3166 codes, `request.region`, `request.city`, `request.asn`, `request.org` — block specific countries, ASNs, or regions
- JA3/JA4 Fingerprinting: `request.ja3` and `request.ja4` for TLS stack identification — block known attack tools even with IP rotation
- IP Reputation: `clofix.ip_reputation()` returns "clean"/"suspicious"/"malicious" — block malicious IPs instantly
- Path Whitelisting: Protect admin endpoints (`/admin`, `/wp-admin`) with IP allowlists using shared dictionaries
- Execution Limits: 50ms wall-clock timeout per script, 32MB memory limit, 200 call stack depth — prevents resource exhaustion
- Directory Structure: `./lua_script/
/` with alphabetical execution order — use numeric prefixes (`01_rate_limit.lua`, `02_bot_detection.lua`) for priority - Domain Configuration: Enable Lua with `lua { enabled on; lua_shared_dict ddos_attack 10m; }` in domain config
💡 How it works: Lua scripts execute in isolated VM instances with 50ms timeout. Files run in alphabetical order — first non-allow action stops pipeline. The `clofix_main(request)` function receives a request object with all HTTP context, GeoIP, JA3 fingerprint, and threat intelligence fields. Shared dictionaries (`clofix.shared.*`) provide thread-safe cross-request storage with TTL. Payload normalization (`clofix.normalize_payload()`) defeats encoding evasion before pattern matching. The scoring engine allows multi-rule accumulation before final action. Structured attack logging (`clofix.log_attack()`) automatically captures full request context for SIEM integration. All functions are C-bound for performance — Lua scripts typically process 80,000 requests/second on modest hardware.
📖 Official Documentation: CloFix Lua Scripting Guide — Complete API reference with SQL injection, XSS, rate limiting, DDoS protection, shared dictionaries, and 15+ production-ready examples
🎯 CloFix Custom Rules & Scripting
Unified rule engine combining CloFixRule directives, JavaScript, and Lua with intelligent bypass system
Key Benefits
- CloFixRule Directive: CRS-style custom rules with variables (ARGS, REQUEST_HEADERS, REQUEST_URI, BODY), operators (@rx regex, @contains, @streq, @pm, @beginsWith, @endsWith), and transformations (t:lowercase, t:urlDecode, t:htmlEntityDecode, t:removeNulls, t:compressWhitespace)
- Multi-Language Support: Choose between declarative CloFixRule (YAML-like), JavaScript (clofix), or Lua (clofix_main) — mix and match in the same deployment with alphabetical execution order
- Intelligent Bypass System: Bypass rules by rule ID, tag (`attack-sqli`, `paranoia-level/3`), phase (1-4 request/response), path (`/health`, `/api/public/*`), or IP (`127.0.0.1`, `192.168.1.*`, `10.0.0.0/8`)
- Anomaly Scoring Engine: Each rule contributes weighted points to anomaly score (CRITICAL=5, ERROR=4, WARNING=3, NOTICE=2, INFO=1). Threshold-based blocking with configurable inbound/outbound limits
- Paranoia Levels 1-4: Progressive protection from minimal false positives (Level 1) to maximum security (Level 4) — adjust per domain or globally
- Pattern Extraction: JavaScript files automatically scanned for strings and regex patterns — used for fast matching without execution overhead
- Shared Dictionaries: Persistent cross-request state with TTL — `sharedDict("name")` in JavaScript, `clofix.shared.*` in Lua, perfect for rate limiting and bot tracking
- Action Types: `block` (403), `allow`, `rate_limit` (429), `challenge` (CAPTCHA), `redirect`, `log_only`, `captcha` — with custom status codes and messages
- Transformation Chains: Apply multiple transformations sequentially — `t:lowercase,t:urlDecode,t:htmlEntityDecode` defeats encoding evasion techniques
- Virtual Patching: Create custom rules to patch vulnerable applications without code changes — deploy within minutes of vulnerability disclosure
- Rule Testing Sandbox: Interactive playground to test custom rules against historical traffic or custom payloads before production deployment
- Pre-built Rule Templates: 200+ community-contributed templates for WordPress, Drupal, Joomla, Magento, Laravel, Django, and custom applications
- API Rate Limiting DSL: Specialized syntax for API protection — per-endpoint limits, burst handling, graduated response (slow down → challenge → block)
- Bot Detection Rules: Pre-configured bot fingerprints for 500+ known bots (Googlebot, Bingbot, ChatGPT, GPTBot, Anthropic) with custom actions per bot type
- Credential Stuffing Protection: Login endpoint velocity checks, password reuse patterns, and known breached credentials via haveibeenpwned API integration
- GraphQL Security Rules: Introspection blocking, depth limiting (default max depth 10), complexity scoring, and batch query throttling
- gRPC Method Filtering: Whitelist/blacklist specific gRPC methods with regex patterns — block reflection services and internal methods from external callers
- JSON Schema Validation: Enforce JSON schemas on API requests — block malformed payloads before they reach your application logic
- XML/SOAP Validation: Detect XML bombs, XXE attacks, and schema violations in SOAP and REST XML payloads
- Custom Response Rules: Inspect and modify responses — add security headers (CSP, HSTS), remove server signatures, inject monitoring scripts, block responses containing sensitive data
- Webhook Actions: Trigger external webhooks on rule matches — send alerts to Slack, PagerDuty, or custom SIEM solutions with full request context
- Delayed Response (Tarpitting): Slow down attackers with configurable delays — waste attacker resources while maintaining legitimate user experience
- Log Sampling: Sample and log only matching rules at configurable rates — reduce log volume while maintaining security visibility
- Rule Groups: Organize rules into named groups (PCI, HIPAA, WordPress, API) — enable/disable entire groups with a single toggle for multi-tenant environments
- Priority Execution: Assign execution priority (1-1000) — ensure critical rules run first while complex analysis runs later. Pre-optimize based on historical match rates
- Rule Metrics Dashboard: Real-time metrics per rule — match count, false positive rate, execution time, and impact score. Identify rules causing latency or blocking legitimate traffic
- Automated Rule Optimization: ML-powered suggestions to reduce false positives — learn from blocked vs. allowed traffic patterns and suggest threshold adjustments
- Rule Export/Import: Export rule sets as YAML/JSON for backup, version control, or sharing across deployments. Import from other CloFix instances or community repositories
- Inline Documentation: Document rules with markdown descriptions, examples, and remediation steps — built-in documentation viewer for security teams
- Rule Scheduling: Schedule rules for specific maintenance windows or seasonal traffic — automatically enable holiday shopping protection, disable during low-traffic periods
💡 How it works: CloFix Custom Rules engine processes rules in execution priority order across three scripting languages. CloFixRule directives are compiled into optimized decision trees for O(log n) lookup times. JavaScript and Lua scripts execute in isolated VMs with 2-second (JS) or 50ms (Lua) timeouts. Files execute alphabetically — use numeric prefixes like `01_rate_limit.js`, `02_bot_detection.lua`, `03_clofixrule.conf` to control pipeline order. The intelligent bypass system supports rule ID, tag, phase, path, and IP bypasses — documented bypasses are essential for production. All rule executions are traced in the audit log with detailed match information for forensics and tuning. Shared dictionaries (`sharedDict` in JS, `clofix.shared` in Lua) maintain cross-request state with TTL support. Pattern extraction from JavaScript files automatically creates fast-matching signatures checked against every request.
📖 Official Documentation: CloFixRule & Custom Rules Guide — Complete syntax reference with variables, operators, transformations, bypass configuration, and 50+ rule examples
Defualt Activeted Protection
🔍 Behavioral Analysis
Advanced browser vs. bot detection using behavioral patterns and TLS fingerprinting
Key Benefits
- Request-1 Blocking: FastBlocker fires on the very first request — no history needed. Missing Sec-Fetch-*, bare Accept headers, and low header count score instantly before any proxying occurs
- JA3 TLS Fingerprinting: Computed directly from Go's tls.ClientHelloInfo via GetConfigForClient hook — no nginx module required. CipherSuites, SupportedVersions, SupportedCurves, SignatureSchemes, ALPN, and SNI all contribute to the hash
- Known Browser Database: Chrome, Firefox, Safari, Edge, Opera, Brave, and Tor Browser JA3 hashes pre-loaded. Exact match = instant allow with zero behavioral scoring overhead
- UA Structure Analysis: Detects tools by shape, not name — no hardcoded tool strings. Checks Mozilla/ token, platform () grouping, and AppleWebKit/Gecko presence. All three must exist simultaneously
- Sec-Fetch Header Detection: Injected by all browsers since Chrome 76 / Firefox 90 — absent in every HTTP library. Missing all three Sec-Fetch-Site/Mode/Dest headers scores +35pts instantly
- Tiered Velocity Scoring: Three escalating tiers — warn (+20), high (+35), extreme (+50) — scored per JA3 fingerprint over a 5-minute sliding window. IP rotation doesn't help if TLS stack is consistent
- Machine Timing Detection: Coefficient of variation (stddev/mean) of inter-request intervals. CV <0.05 AND mean <2s = machine precision timing (+45pts). Requires only 4 requests to compute
- Uniform Response Time Detection: Tools receive consistent server response times. CV <0.1 across 6+ requests flags automated polling (+20pts)
- Shannon Path Entropy: Entropy <0.6 on normalized paths = scanner repeating same endpoints (+20pts). Entropy <0.3 with 10+ requests = very low entropy (+35pts). Paths normalized: /api/users/123 → /api/users/*
- Sequential Enumeration: Detects /item/1, /item/2, /item/3 numeric crawl patterns. Fires when >30% of consecutive path pairs are sequential (+35pts)
- High Path Density: >90% unique paths in <8 requests = scanner walking endpoints (+25pts). Combined with velocity = strong scanner signal
- Zero Static Assets: Real users load CSS/JS/images — tools never do. 0% static asset ratio after 10+ requests adds +30pts. Checked against 18 file extensions
- Method Probing Detection: 4+ distinct HTTP methods (GET/POST/PUT/DELETE/PATCH/OPTIONS/HEAD) against the same path = method enumeration attack (+30pts)
- Error Rate Analysis: Three tiers — elevated (>25% 4xx → +12pts), high (>50% 4xx/5xx → +25pts), 404-dominant (>50% 404 → +35pts). Distinguishes path probing from application errors
- Parameter Fuzzing Detection: Same endpoint with 10+ unique parameter names across 20+ requests = automated parameter discovery (+30pts)
- UA Rotation Detection: >30% unique User-Agents across 10+ requests = evasion attempt via UA cycling (+25pts)
- Burst Pattern Detection: Zero requests in the prior 9-minute window followed by 20+ in the last minute = attack burst after reconnaissance silence (+30pts)
- Path Traversal Scoring: Double-dot sequences (../, ..\, %2e%2e), null bytes (\x00, %00), CRLF injection (\r, \n) in request paths scored independently in both FastBlocker and BehaviorEngine layers
- Query String Injection: Structural injection patterns in query strings — union+select, <script, onerror=, exec(, base64_decode(, javascript: — scored +50–55pts on first occurrence
- Sticky Block System: Score ≥70 triggers a 15-minute hard block written to the profile. Pre-request IsBlocked() check fires before WAF rules, DDoS engine, or upstream proxy
- Block Auto-Expiry: Block TTL auto-expires on the next request after 15 minutes. Profile demoted to challenge state rather than deleted — retains behavioral history
- Session Trust Bonus: Established sessions older than 10 minutes with score <20 receive a −15pts reduction. Prevents over-blocking legitimate power users
- New Profile Penalty: Profile younger than 10 seconds with 15+ requests scores +20pts — human-impossible volume in that window
- Domain Isolation: Profile store is per-domain. Dashboard locked to r.Host — ?domain= query parameter is completely ignored server-side, preventing cross-tenant data leakage
- IP Rate Limiter: Sliding window 30 req/10s per IP. Fires independently of behavioral scoring — instant 5-minute block regardless of headers or UA
- Health Check Bypass: Silent monitoring probes (no UA, GET /, no body) are whitelisted at FastBlocker level — load balancer checks never accumulate false-positive scores
- Learning Mode: Monitor-only mode records detections and flags profiles without blocking. Safe for baseline establishment. Toggle live via /waf-dashboard/behavior-learning endpoint
- Profile Ring Buffer: Each profile stores the last 100 requests in memory with O(1) eviction. Fixed memory footprint regardless of request volume
- Background Sweeper: Idle profiles evicted every 5 minutes after 30-minute TTL. Prevents unbounded memory growth under sustained scan traffic
- 2 Layers, 20+ Signals: Layer 1 (FastBlocker) — 7 instant signals on request 1. Layer 2 (BehaviorEngine) — 13 multi-request signals over sliding 5-minute window. Both run synchronously before upstream proxy. No external dependencies — no Redis, no database, no sidecar
💡 How it works: Every request passes through two independent scoring layers. FastBlocker evaluates structural signals immediately - Sec-Fetch headers, Accept quality, header count, UA shape, path anomalies, and IP rate. BehaviorEngine builds a per-fingerprint profile and scores velocity, timing regularity, path entropy, error rates, static asset ratio, burst patterns, and more over a sliding 5-minute window. A fingerprint reaching score ≥70 is sticky-blocked for 15 minutes. JA3 hash from the TLS ClientHello is the primary profile key - IP rotation, VPN hops, and proxy chains don't reset the profile if the TLS fingerprint is consistent. The entire system runs in-process with no external dependencies.
AI-Powered Protection
🔍 Fingerprint Blocking
Blocks requests based on malicious browser/device fingerprinting patterns
Blocks requests based on malicious browser/device fingerprinting patterns.
- Detects abnormal browser fingerprints
- Identifies spoofed user agents
- Blocks headless browser signatures
- Prevents fingerprint-based evasion techniques
📦 Payload Blocking
Detects and blocks malicious payloads in requests
Detects and blocks malicious payloads in requests using AI-powered analysis.
- Real-time payload inspection
- ML-based threat classification
- Zero-day exploit detection
- Multi-vector payload analysis
📊 Traffic Anomaly Blocking
Identifies and blocks abnormal traffic patterns
Identifies and blocks abnormal traffic patterns using behavioral analysis.
- Detects traffic spikes and anomalies
- Identifies DDoS attack patterns
- Behavioral baselining
- Automated threat response
🚫 IP Reputation Blocking
Blocks requests from known malicious IP addresses
Blocks requests from known malicious IP addresses using real-time threat intelligence.
- Integration with blocklist.de
- Real-time IP reputation checks
- Dynamic blacklist updates
- Custom IP blacklisting
🕸️ JavaScript Behavior Blocking
Analyzes and blocks suspicious JavaScript behavior
Analyzes and blocks suspicious JavaScript behavior in real-time.
- Detects malicious JS execution
- Identifies cryptojacking attempts
- Blocks DOM manipulation attacks
- Prevents JS-based data exfiltration
🍪 Cookie Validation Blocking
Validates and blocks requests with tampered cookies
Validates and blocks requests with tampered cookies using AI-based scoring.
- Detects cookie tampering attempts
- Validates session integrity
- Blocks session hijacking
- Prevents replay attacks
📱 Device Identity Blocking
Blocks requests from untrusted or spoofed devices
Blocks requests from untrusted or spoofed devices using device fingerprinting.
- Device fingerprint validation
- Detects emulator environments
- Blocks device spoofing
- Cross-session device tracking
🤖 Automation Tool Blocking
Detects and blocks automated bot/script traffic
Detects and blocks automated bot/script traffic with high accuracy.
- Detects Selenium, Puppeteer, Playwright
- Identifies headless browsers
- Blocks scraping tools
- Prevents automated attacks
☁️ Cloud Service Blocking
Blocks requests from known cloud hosting providers (if malicious)
Blocks requests from known cloud hosting providers when malicious patterns are detected.
- Identifies cloud data center traffic
- Blocks malicious cloud-based attacks
- AWS/Azure/GCP detection
- Cloud IP range filtering
🔄 DNS Rebinding Blocking
Prevents DNS rebinding attacks
Prevents DNS rebinding attacks through intelligent detection.
- Detects DNS rebinding patterns
- Validates DNS responses
- Blocks internal IP exposure
- Prevents SSRF via DNS rebinding
🔑 Credential Stuffing Blocking
Detects and blocks credential stuffing attempts
Detects and blocks credential stuffing attempts using behavioral analysis.
- Identifies rapid login attempts
- Detects password spraying
- Blocks breached credential use
- Rate limiting for auth endpoints
🕷️ Crawler Detection Blocking
Identifies and blocks malicious web crawlers
Identifies and blocks malicious web crawlers while allowing legitimate search engines.
- Differentiates good/bad crawlers
- Validates search engine bots
- Blocks content scrapers
- Prevents competitive data mining
🔌 API Abuse Blocking
Prevents API abuse and excessive API calls
Prevents API abuse and excessive API calls using ML-based detection.
- Detects API scraping
- Identifies abnormal API patterns
- Prevents business logic abuse
- Intelligent rate limiting
📨 Header Injection Blocking
Blocks HTTP header injection attacks
Blocks HTTP header injection attacks through comprehensive validation.
- Detects CRLF injection
- Prevents response splitting
- Blocks host header attacks
- Validates all HTTP headers
🔒 TLS Fingerprint Blocking
Blocks requests based on malicious TLS fingerprint patterns (JA3)
Blocks requests based on malicious TLS fingerprint patterns (JA3/JA3S).
- JA3 fingerprint analysis
- Detects malicious TLS clients
- Identifies bot TLS patterns
- Blocks known attack tools
🛡️ SSL MITM Blocking
Detects and blocks SSL Man-in-the-Middle attacks
Detects and blocks SSL Man-in-the-Middle attacks through advanced analysis.
- Detects SSL stripping
- Identifies certificate anomalies
- Blocks MITM proxies
- Validates TLS handshakes
↪️ Open Redirect Blocking
Prevents open redirect vulnerabilities
Prevents open redirect vulnerabilities through intelligent URL validation.
- Detects malicious redirects
- Validates redirect URLs
- Blocks phishing attempts
- Prevents open redirect exploitation
🎭 Fake Bot Blocking
Blocks fake/search engine bot impersonation
Blocks fake/search engine bot impersonation through rigorous validation.
- Validates search engine IPs
- Detects bot impersonation
- Reverse DNS verification
- Blocks fake crawlers
⚡ AI Rate Limit Blocking
AI-based intelligent rate limiting
AI-based intelligent rate limiting that adapts to traffic patterns.
- Dynamic rate limiting
- Behavior-based thresholds
- Adaptive response
- Prevents DDoS and abuse
🔐 JA3 Check
Validates JA3 TLS fingerprint against known malicious patterns
Validates JA3 TLS fingerprint against known malicious patterns.
- JA3 blacklist matching
- Malicious client detection
- Attack tool identification
- Custom JA3 rules
🖥️ VM/Debug Detection Blocking
Blocks requests from virtual machines/debugging environments
Blocks requests from virtual machines and debugging environments.
- Detects VM environments
- Identifies debugger presence
- Blocks sandbox evasion
- Prevents analysis evasion
🎨 Canvas Fingerprint Blocking
Blocks based on malicious canvas fingerprinting
Blocks requests based on malicious canvas fingerprinting patterns.
- Detects canvas fingerprinting
- Blocks tracking attempts
- Identifies automation tools
- Prevents browser profiling
📁 Path Traversal Blocking
Prevents directory/path traversal attacks
Prevents directory/path traversal attacks through comprehensive filtering.
- Blocks ../ patterns
- Prevents directory listing
- Protects sensitive files
- URL encoding detection
💾 SQL Injection Blocking
Detects and blocks SQL injection attempts
Detects and blocks SQL injection attempts using advanced pattern matching.
- Blocks UNION-based attacks
- Detects time-based injection
- Prevents error-based disclosure
- Blocks stacked queries
⚠️ XSS Detection Blocking
Prevents Cross-Site Scripting (XSS) attacks
Prevents Cross-Site Scripting (XSS) attacks through comprehensive filtering.
- Blocks reflected XSS
- Prevents stored XSS
- Detects DOM-based XSS
- Filters malicious scripts
⌨️ Command Injection Blocking
Blocks OS command injection attempts
Blocks OS command injection attempts through rigorous input validation.
- Detects shell metacharacters
- Blocks command chaining
- Prevents RCE attempts
- Filters dangerous commands
📄 XXE Detection Blocking
Prevents XML External Entity attacks
Prevents XML External Entity attacks through XML parsing protection.
- Blocks external entity expansion
- Prevents XXE-based SSRF
- Disables dangerous DTDs
- Filters malicious XML
📋 LDAP Injection Blocking
Blocks LDAP injection attempts
Blocks LDAP injection attempts through comprehensive input filtering.
- Detects LDAP metacharacters
- Blocks filter manipulation
- Prevents LDAP query tampering
- Input sanitization
🍃 NoSQL Injection Blocking
Prevents NoSQL database injection attacks
Prevents NoSQL database injection attacks through specialized filtering.
- Detects MongoDB operators
- Blocks JavaScript injection
- Prefers parameter pollution
- Validates JSON inputs
📝 SSTI Detection Blocking
Blocks Server-Side Template Injection attacks
Blocks Server-Side Template Injection attacks across multiple template engines.
- Detects template syntax
- Blocks RCE via templates
- Prevents information disclosure
- Engine-specific detection
🔄 CSRF Check Blocking
Prevents Cross-Site Request Forgery attacks
Prevents Cross-Site Request Forgery attacks through token validation.
- CSRF token validation
- Origin header checking
- Same-site verification
- Anti-automation measures
🖱️ Clickjacking Blocking
Prevents clickjacking/frame hijacking attempts
Prevents clickjacking and frame hijacking attempts.
- X-Frame-Options enforcement
- CSP frame-ancestors directive
- Frame-busting detection
- UI redress attack prevention
🔍 Vulnerability Scanner Blocking
Blocks automated vulnerability scanners
Blocks automated vulnerability scanners through advanced detection.
- Detects scanner fingerprints
- Blocks common scanning tools
- Identifies reconnaissance
- Prevents vulnerability probing
💻 Terminal Access Blocking
Prevents unauthorized terminal/console access
Prevents unauthorized terminal and console access attempts.
- Blocks reverse shells
- Detects command injection
- Prevents RCE attempts
- Filters shell commands
🛡️ jQuery Guard Blocking
Protects against jQuery-based attacks
Protects against jQuery-based attacks and vulnerabilities.
- Blocks jQuery XSS vectors
- Prevents jQuery DOM manipulation
- Detects jQuery exploitation
- CVE-specific protections
📡 Scan Technique Blocking
Blocks advanced scanning techniques
Blocks advanced scanning techniques used by professional attackers.
- Detects slow scans
- Blocks distributed scanning
- Identifies evasion techniques
- Prevents fingerprinting
📜 Script Detector Blocking
Detects and blocks malicious script execution attempts
Comprehensive script analysis and malicious execution detection
- Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
- Request Fingerprinting - Analyzes header patterns and capitalization
- Timing Humanity Analysis - Statistical analysis of request timing patterns
- Resource Loading Detection - Analyzes resource loading behavior
- Session Behavior Analysis - Tracks session patterns and navigation flows
- Payload Consistency - Detects automated payload generation
- Error Handling Analysis - Identifies automated error recovery patterns
- Basic Headless Detection - Traditional headless browser detection
- Missing Browser Headers - Identifies missing standard browser headers
- Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
- Advanced Headless Detection - 25+ headless variants detection
- Playwright/Selenium Fingerprinting - Version-specific detection
- Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
- Curl/Wget Detection - Command-line tool fingerprinting
- Python Requests Detection - Python HTTP library detection
- VM Environment Detection - Virtual machine/container detection
- Automation Timing Patterns - Advanced statistical timing analysis
- Missing JS Evidence - Detects lack of JavaScript execution
- Cookie Handling Anomalies - Identifies automated cookie management
- DevTools Protocol - Detects CDP usage
- Advanced Headless - Cloud headless services detection
- ML-Based Detection - Machine learning classification (optional)
- Human Biometric - Mouse/touch/keystroke pattern analysis
- Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
- Advanced Evasion - Detects anti-detection techniques
👤 Behavior Detector Blocking
Analyzes user behavior patterns to identify anomalies
Advanced behavioral analysis for human vs automated detection
- Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
- Request Fingerprinting - Analyzes header patterns and capitalization
- Timing Humanity Analysis - Statistical analysis of request timing patterns
- Resource Loading Detection - Analyzes resource loading behavior
- Session Behavior Analysis - Tracks session patterns and navigation flows
- Payload Consistency - Detects automated payload generation
- Error Handling Analysis - Identifies automated error recovery patterns
- Basic Headless Detection - Traditional headless browser detection
- Missing Browser Headers - Identifies missing standard browser headers
- Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
- Advanced Headless Detection - 25+ headless variants detection
- Playwright/Selenium Fingerprinting - Version-specific detection
- Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
- Curl/Wget Detection - Command-line tool fingerprinting
- Python Requests Detection - Python HTTP library detection
- VM Environment Detection - Virtual machine/container detection
- Automation Timing Patterns - Advanced statistical timing analysis
- Missing JS Evidence - Detects lack of JavaScript execution
- Cookie Handling Anomalies - Identifies automated cookie management
- DevTools Protocol - Detects CDP usage
- Advanced Headless - Cloud headless services detection
- ML-Based Detection - Machine learning classification (optional)
- Human Biometric - Mouse/touch/keystroke pattern analysis
- Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
- Advanced Evasion - Detects anti-detection techniques
☠️ C2 Detector Blocking
Identifies Command & Control communication patterns
Advanced Command & Control communication detection and blocking
- Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
- Request Fingerprinting - Analyzes header patterns and capitalization
- Timing Humanity Analysis - Statistical analysis of request timing patterns
- Resource Loading Detection - Analyzes resource loading behavior
- Session Behavior Analysis - Tracks session patterns and navigation flows
- Payload Consistency - Detects automated payload generation
- Error Handling Analysis - Identifies automated error recovery patterns
- Basic Headless Detection - Traditional headless browser detection
- Missing Browser Headers - Identifies missing standard browser headers
- Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
- Advanced Headless Detection - 25+ headless variants detection
- Playwright/Selenium Fingerprinting - Version-specific detection
- Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
- Curl/Wget Detection - Command-line tool fingerprinting
- Python Requests Detection - Python HTTP library detection
- VM Environment Detection - Virtual machine/container detection
- Automation Timing Patterns - Advanced statistical timing analysis
- Missing JS Evidence - Detects lack of JavaScript execution
- Cookie Handling Anomalies - Identifies automated cookie management
- DevTools Protocol - Detects CDP usage
- Advanced Headless - Cloud headless services detection
- ML-Based Detection - Machine learning classification (optional)
- Human Biometric - Mouse/touch/keystroke pattern analysis
- Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
- Advanced Evasion - Detects anti-detection techniques
⚔️ Attack Detector Blocking
Multi-vector attack detection and prevention
Comprehensive multi-vector attack detection system
- Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
- Request Fingerprinting - Analyzes header patterns and capitalization
- Timing Humanity Analysis - Statistical analysis of request timing patterns
- Resource Loading Detection - Analyzes resource loading behavior
- Session Behavior Analysis - Tracks session patterns and navigation flows
- Payload Consistency - Detects automated payload generation
- Error Handling Analysis - Identifies automated error recovery patterns
- Basic Headless Detection - Traditional headless browser detection
- Missing Browser Headers - Identifies missing standard browser headers
- Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
- Advanced Headless Detection - 25+ headless variants detection
- Playwright/Selenium Fingerprinting - Version-specific detection
- Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
- Curl/Wget Detection - Command-line tool fingerprinting
- Python Requests Detection - Python HTTP library detection
- VM Environment Detection - Virtual machine/container detection
- Automation Timing Patterns - Advanced statistical timing analysis
- Missing JS Evidence - Detects lack of JavaScript execution
- Cookie Handling Anomalies - Identifies automated cookie management
- DevTools Protocol - Detects CDP usage
- Advanced Headless - Cloud headless services detection
- ML-Based Detection - Machine learning classification (optional)
- Human Biometric - Mouse/touch/keystroke pattern analysis
- Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
- Advanced Evasion - Detects anti-detection techniques
🤖 AI Attack Detector Blocking
Advanced AI-powered attack detection for zero-day threats
Next-generation AI-powered threat detection for zero-day and emerging attacks
- Browser Imitation Detection - Detects spoofed user agents and header inconsistencies
- Request Fingerprinting - Analyzes header patterns and capitalization
- Timing Humanity Analysis - Statistical analysis of request timing patterns
- Resource Loading Detection - Analyzes resource loading behavior
- Session Behavior Analysis - Tracks session patterns and navigation flows
- Payload Consistency - Detects automated payload generation
- Error Handling Analysis - Identifies automated error recovery patterns
- Basic Headless Detection - Traditional headless browser detection
- Missing Browser Headers - Identifies missing standard browser headers
- Automation Indicators - Detects Selenium, Puppeteer, Playwright, etc.
- Advanced Headless Detection - 25+ headless variants detection
- Playwright/Selenium Fingerprinting - Version-specific detection
- Puppeteer/CDP Detection - Chrome DevTools Protocol analysis
- Curl/Wget Detection - Command-line tool fingerprinting
- Python Requests Detection - Python HTTP library detection
- VM Environment Detection - Virtual machine/container detection
- Automation Timing Patterns - Advanced statistical timing analysis
- Missing JS Evidence - Detects lack of JavaScript execution
- Cookie Handling Anomalies - Identifies automated cookie management
- DevTools Protocol - Detects CDP usage
- Advanced Headless - Cloud headless services detection
- ML-Based Detection - Machine learning classification (optional)
- Human Biometric - Mouse/touch/keystroke pattern analysis
- Hardware Fingerprinting - GPU, CPU, canvas fingerprinting
- Advanced Evasion - Detects anti-detection techniques
Core Security Features
🛡️ Advanced DDoS Protection
Multi-layer protection against volumetric, protocol, and application-layer DDoS attacks
Advanced multi-layer DDoS mitigation designed to protect infrastructure, APIs, and applications from distributed denial-of-service attacks.
🌐 Volumetric Attacks
- HTTP / HTTPS Flood
- SYN Flood
- UDP / ICMP Flood
- Amplification Attacks (DNS, NTP, Memcached, SSDP)
- Distributed HTTP Flood
- Layer-7 Bandwidth Exhaustion
⚙ Protocol Attacks
- Slowloris
- Slow-Read Attack
- RUDY (Slow POST)
- Ping-of-Death
- TCP Null / FIN / Xmas Flag Attacks
- LAND Attack
- IP Fragmentation Flood
- Malformed HTTP Requests
- Oversized Headers
- Keep-Alive Connection Abuse
🌍 Application Layer (L7)
- HTTP Flood (Layer-7)
- Cache-Busting Attacks
- Path Focusing Attacks
- Hash-Collision DoS
- Recursive / Deep GET Attacks
- Query-String Flood
- Form Parameter Flood
- Resource Exhaustion
- Regex DoS (ReDoS Probes)
🔗 API & Modern Application Attacks
- GraphQL Depth Bomb
- GraphQL Introspection Probing
- GraphQL Batch Abuse
- REST Endpoint Hammering
- API Key Brute-Force
- WebSocket Flood
- JSON Bomb / Nested Object Payload
💼 Business Logic Abuse
- Login Flood
- Credential Stuffing
- Upload Size Abuse
- Upload Rate Abuse
- OTP / Verification Code Hammering
- Coupon / Voucher Abuse
- Account Enumeration
- Password Spraying
- Checkout Flood
🧠 Behavioral & Threat Intelligence
- Error Flood Detection
- Missing / Spoofed User-Agent
- Known Bad Bot Detection
- Headless Browser Fingerprinting
- Scanner / Probe Signature Detection
- TOR Exit Node Indicator
- Session Abuse Detection
- Path Enumeration Detection
- Reputation-Based Risk Scoring
- Geo-Location Anomaly Detection
🔒 SQL Injection Protection (A1)
Protects against SQL injection attacks (OWASP Top 10 A1)
Comprehensive protection against SQL injection attacks, addressing OWASP Top 10 A1.
- Advanced SQLi detection
- Prevents data exfiltration
- Blocks injection attempts
- Database-agnostic protection
🔐 Sensitive Data Encryption (A3)
Ensures sensitive data is properly encrypted (OWASP Top 10 A3)
Ensures sensitive data is properly encrypted and protected.
- Automatic encryption enforcement
- Prevents data leakage
- PCI-DSS compliance support
- GDPR data protection
📄 XML External Entities Blocked (A4)
Prevents XXE attacks (OWASP Top 10 A4)
Prevents XML External Entity attacks through comprehensive XML filtering.
- Blocks external entity expansion
- Prevents XXE-based SSRF
- Disables dangerous DTDs
- XML parsing protection
📁 Path Traversal Protection (A5)
Blocks directory/path traversal attempts (OWASP Top 10 A5)
Blocks directory/path traversal attempts, addressing OWASP Top 10 A5.
- Blocks directory traversal
- Prevents file access
- Protects sensitive paths
- URL normalization
⚙️ Misconfiguration Scan (A6)
Detects and blocks security misconfigurations (OWASP Top 10 A6)
Detects and blocks security misconfigurations, addressing OWASP Top 10 A6.
- Scans for misconfigurations
- Blocks exposed admin panels
- Prevents default credential use
- Security header validation
⚠️ XSS Protection (A7)
Prevents Cross-Site Scripting attacks (OWASP Top 10 A7)
Prevents Cross-Site Scripting attacks, addressing OWASP Top 10 A7.
- Reflected XSS prevention
- Stored XSS blocking
- DOM-based XSS protection
- Content Security Policy
📦 Insecure Deserialization Block (A8)
Blocks insecure deserialization attempts (OWASP Top 10 A8)
Blocks insecure deserialization attempts, addressing OWASP Top 10 A8.
- Detects malicious serialized objects
- Blocks RCE via deserialization
- Prevents object injection
- Java/PHP/Python protection
📊 Logging and Monitoring (A10)
Ensures proper logging and monitoring (OWASP Top 10 A10)
Ensures proper logging and monitoring, addressing OWASP Top 10 A10.
- Comprehensive request logging
- Real-time threat monitoring
- ClickHouse analytics
- Alert generation
🐌 Slowloris Protection
Protects against Slowloris DDoS attacks
Protects against Slowloris DDoS attacks through connection management.
- Detects slow connections
- Manages partial requests
- Timeout enforcement
- Connection limiting
📏 Header Length Limit
Limits maximum HTTP header length to 3019 bytes
Limits maximum HTTP header length to 3019 bytes to prevent buffer overflow attacks.
- Enforces header size limits
- Prevents header overflow
- Blocks oversized requests
- Memory protection
🌊 Flooding Attacks Protection
Protects against request flooding attacks
Protects against request flooding attacks through intelligent rate control.
- Detects request bursts
- Blocks flood attacks
- Adaptive rate limiting
- DDoS mitigation
🔍 Header Scan Protection
Scans and validates HTTP headers for attacks
Scans and validates HTTP headers for potential attacks and anomalies.
- Header injection detection
- Malformed header blocking
- Security header validation
- Custom header rules
🍪 Cookie Tampering Protection
Prevents cookie modification/tampering attempts
Prevents cookie modification and tampering attempts through validation.
- Cookie integrity checking
- Encryption enforcement
- Session fixation prevention
- Tamper detection
🔑 Session Cookie Validation
Validates session cookies for security
Validates session cookies to ensure session integrity and security.
- Session ID validation
- Expiration checking
- Signature verification
- Replay attack prevention
📊 Client Behavior Analysis
Analyzes client behavior patterns for anomalies
Analyzes client behavior patterns to detect anomalies and threats.
- Behavioral baselining
- Anomaly detection
- Session analysis
- Pattern recognition
🚫 Block Malformed Headers
Blocks requests with malformed/invalid HTTP headers
Blocks requests with malformed or invalid HTTP headers.
- Header syntax validation
- Protocol compliance
- Blocks malformed requests
- Prevents evasion
🔄 CSRF Protection
Prevents Cross-Site Request Forgery attacks
Prevents Cross-Site Request Forgery attacks through multiple layers.
- Token validation
- Origin checking
- SameSite enforcement
- Anti-automation
🌐 SSRF Protection
Blocks Server-Side Request Forgery attempts
Blocks Server-Side Request Forgery attempts through comprehensive filtering.
- Blocks internal IP requests
- Prevents metadata access
- URL validation
- DNS rebinding protection
⌨️ Command Injection Protection
Prevents OS command injection attacks
Prevents OS command injection attacks through rigorous input validation.
- Shell metacharacter filtering
- Command chaining prevention
- RCE attempt blocking
- Input sanitization
🔨 Brute Force Protection
Protects against brute force login attempts
Protects against brute force login attempts through intelligent rate limiting.
- Login attempt limiting
- IP-based blocking
- CAPTCHA integration
- Account lockout
🔄 DNS Rebinding Protection
Prevents DNS rebinding attacks
Prevents DNS rebinding attacks through intelligent DNS validation.
- DNS response validation
- Internal IP blocking
- Pin-based protection
- Same-origin enforcement
⏱️ Time Check Client Protection
Validates client time-based security checks
Validates client time-based security checks to prevent replay and automation.
- Timestamp validation
- Request freshness checks
- Replay attack prevention
- Time-based tokens
🧅 Tor Exit Node Blocking
Blocks requests from Tor exit nodes
Blocks requests from Tor exit nodes to prevent anonymous attacks.
- Tor exit node detection
- Real-time node list updates
- Anonymous traffic blocking
- Custom allowlisting
🔒 Information Detected Protection
Prevents information disclosure/sensitive data exposure
Prevents information disclosure and sensitive data exposure.
- PII detection and blocking
- Credential leak prevention
- API key masking
- Error message sanitization
📁 Extension Protection
Protects against malicious file extension attacks
Protects against malicious file extension attacks and uploads.
- Blocks dangerous extensions
- File type validation
- MIME type checking
- Upload filtering
🌍 IP Reputation Check
Checks IP addresses against reputation databases
Checks IP addresses against reputation databases for threat intelligence.
- Real-time reputation checks
- Multiple feed integration
- Malicious IP blocking
- Dynamic blacklisting
🕶️ Block Headless Browser
Detects and blocks headless browser automation
Detects and blocks headless browser automation tools.
- Headless Chrome detection
- Puppeteer/Playwright blocking
- PhantomJS detection
- Automation fingerprinting
📝 Payload Signature Check
Validates payloads against rules/payload_signatures.txt
Validates payloads against comprehensive signature database.
- Signature-based detection
- Custom rule support
- Pattern matching
- Known attack blocking
🎥 Video Download Protection
Protects video content from unauthorized download
Protects video content (mp4, mp3, m3u8, png) from unauthorized download.
- Stream protection
- Hotlink prevention
- Download blocking
- Content access control
📜 WAF JS Inject
Injects JavaScript protection into web pages
Injects JavaScript protection into web pages for client-side security.
- Bot detection scripts
- Behavioral analysis
- Client fingerprinting
- Anti-automation measures
🌐 IPv6 Protection
Enables security protections for IPv6 traffic
Enables comprehensive security protections for IPv6 traffic.
- IPv6 attack detection
- IPv6 reputation checks
- IPv6 rate limiting
- IPv6 geo-blocking
📁 Local File Inclusion (LFI) Protection
Prevents attackers from including/reading local files on the server
Comprehensive protection against Local File Inclusion (LFI) attacks that attempt to read sensitive files on the server.
🔍 Path Traversal Detection
- Blocks directory traversal sequences (../, ..\, %2e%2e%2f)
- Detects encoded traversal patterns
- Prevents null byte injection (%00)
- Blocks access to sensitive system files
📄 Sensitive File Protection
- /etc/passwd, /etc/shadow blocking
- Windows system file protection (boot.ini, win.ini)
- Application source code protection
- Configuration file access prevention
🔌 PHP Wrapper Blocking
- php://filter, php://input
- expect:// wrapper
- data://, zlib://, zip://
- phar://, glob:// wrappers
🛡️ Advanced Features
- Real-time payload signature matching
- URL normalization and decoding
- Path canonicalization checks
- Automated IP banning for repeat offenders
- Comprehensive attack logging
🌐 Remote File Inclusion (RFI) Protection
Blocks attempts to include remote malicious files from external servers
Advanced protection against Remote File Inclusion (RFI) attacks that attempt to load and execute malicious code from external servers.
🌍 Remote URL Blocking
- Blocks http://, https:// inclusions
- Prevents ftp://, sftp://, file:// usage
- Blocks data://, input:// wrappers
- Detects base64 encoded remote inclusions
🚫 Malicious Domain Filtering
- Blocks known malicious domains and IPs
- Filters suspicious TLDs (.ru, .cn, .tk, .ml, .ga, .cf, .xyz)
- Prevents connection to anonymous hosting
- Custom domain blacklist support
🔍 PHP Function Monitoring
- Detects include()/require() with remote URLs
- Monitors allow_url_include/fopen settings
- Blocks curl_exec() with external URLs
- Prevents file_get_contents() abuse
🛡️ Protection Features
- Real-time payload signature matching
- Multi-vector input inspection
- URL validation and sanitization
- Automated IP banning for attacks
- Detailed forensic logging
📊 Attack Vectors Covered
- Query string parameters
- POST form data
- Cookie values
- HTTP headers
- File uploads (indirect RFI)
Additional Security Features
🔔 Real-Time Alerts - Slack
Sends real-time security alerts and notifications to Slack channel
Sends real-time security alerts and notifications to Slack channels.
- Instant threat notifications
- Custom alert rules
- Incident reporting
- Team collaboration
📝 Lua Scripting Support
Custom security logic implementation using Lua scripting
Custom security logic implementation using Lua scripting for flexibility.
- Custom rule creation
- Dynamic response logic
- Integration capabilities
- Extensible architecture
🔒 VPN Blocking
Detects and blocks requests from VPN services and proxies
Detects and blocks requests from VPN services and proxy networks.
- VPN IP detection
- Proxy server blocking
- Anonymizer detection
- Datacenter proxy filtering
🤖 Bad Bot Blocking
Identifies and blocks malicious bot traffic
Identifies and blocks malicious bot traffic while allowing legitimate bots.
- Malicious bot detection
- Scraper blocking
- Credential stuffing prevention
- Automated attack mitigation
📱 Agent UA Blocking
Blocks requests based on suspicious User-Agent strings
Blocks requests based on suspicious or malicious User-Agent strings.
- Suspicious UA detection
- Empty UA blocking
- Known malicious UA filtering
- Custom UA rules
🔍 SEO Bot Analysis
Analyzes and validates legitimate search engine bots
Analyzes and validates legitimate search engine bots for SEO optimization.
- Googlebot verification
- Bingbot validation
- Reverse DNS checking
- Bot allowlisting
📝 Signatures Blocking
Blocks requests matching known attack signatures
Blocks requests matching known attack signatures from comprehensive databases.
- CVE signature matching
- Attack pattern detection
- Custom signature support
- Regular updates
🧅 Tor Exit Node Monitor and Blocking
Monitors and blocks requests from Tor exit nodes
Monitors and blocks requests from Tor exit nodes with real-time updates.
- Tor network monitoring
- Exit node detection
- Anonymous traffic blocking
- Custom exemptions
🚫 IP Blocking
Blocks requests from specific IP addresses or IP ranges
Blocks requests from specific IP addresses or IP ranges with flexible rules.
- Single IP blocking
- CIDR range blocking
- Dynamic blacklisting
- Whitelist support
📁 Path Blocking
Blocks access to specific URL paths/directories
Blocks access to specific URL paths and directories for granular control.
- Sensitive path protection
- Admin area blocking
- Pattern-based blocking
- Exception handling
📨 Headers Blocking
Blocks requests containing specific HTTP headers
Blocks requests containing specific HTTP headers or header patterns.
- Suspicious header filtering
- Header value validation
- Custom header rules
- Header injection prevention
🌐 Hostname Blocking
Blocks requests based on hostname/domain
Blocks requests based on hostname or domain for virtual host protection.
- Domain-based filtering
- Subdomain blocking
- Referrer validation
- Host header protection
🗺️ Country Blocking
Blocks traffic from specific countries (geo-blocking)
Blocks traffic from specific countries with granular geo-blocking controls.
- Country-level filtering
- Region-based blocking
- GeoIP database integration
- Allow/block lists
📄 Body Content Blocking
Blocks requests containing specific patterns in request body
Blocks requests containing specific patterns in request body for deep inspection.
- POST data filtering
- JSON payload inspection
- XML content validation
- Malicious pattern detection
🔍 Query Blocking
Blocks requests based on query string parameters
Blocks requests based on query string parameters and patterns.
- SQL injection detection
- XSS in query params
- Parameter pollution prevention
- Custom query filtering
🆔 CloFix ID Blocking
Blocks specific CloFix identification patterns
Blocks specific CloFix identification patterns for advanced threat detection.
- ID pattern matching
- Fingerprint validation
- Custom ID blocking
- Anomaly detection
🔢 ASN Blocking
Blocks traffic from specific Autonomous System Numbers
Blocks traffic from specific Autonomous System Numbers for network-level control.
- ASN-based filtering
- ISP/network blocking
- Cloud provider filtering
- Bogon ASN prevention