> ## Documentation Index
> Fetch the complete documentation index at: https://docs.recon44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Web Application Firewall (WAF) — How It Works

> Recon44's WAF inspects every request against 200+ OWASP Core Rule Set patterns and blocks SQLi, XSS, RCE, path traversal, and SSTI in under 50ms.

Every request that reaches your domain passes through Recon44's Web Application Firewall before it gets anywhere near your origin server. The WAF evaluates the request against a comprehensive set of attack signatures and either allows it through, blocks it outright, or flags it for review — all within a single network hop at the edge.

## What the WAF inspects

The WAF analyzes the full request: URL path, query string, request headers, cookies, and request body. It looks for known attack payloads embedded in any of these fields.

<CardGroup cols={2}>
  <Card title="SQL injection (SQLi)" icon="database">
    Detects attempts to manipulate database queries via user-supplied input, including UNION-based, error-based, and blind injection techniques.
  </Card>

  <Card title="Cross-site scripting (XSS)" icon="code">
    Catches reflected, stored, and DOM-based XSS payloads targeting browsers that process your responses.
  </Card>

  <Card title="Remote code execution (RCE)" icon="terminal">
    Blocks payloads that attempt to execute shell commands or server-side code through vulnerable input handlers.
  </Card>

  <Card title="Path traversal" icon="folder-open">
    Stops requests that use `../` sequences and encoded variants to read files outside the web root.
  </Card>

  <Card title="Server-side template injection (SSTI)" icon="file-code">
    Identifies template expression syntax (e.g., `{{7*7}}`) that exploits template engines running on your server.
  </Card>

  <Card title="Protocol & encoding abuse" icon="shield-halved">
    Normalizes and decodes requests before matching, catching double-encoded and obfuscated payloads that bypass naive filters.
  </Card>
</CardGroup>

## OWASP Core Rule Set matching

Recon44's WAF is built on the [OWASP Core Rule Set (CRS)](https://coreruleset.org/) — the same rule set used by Cloudflare and AWS WAF. Each rule has a unique identifier so you can trace exactly which pattern triggered a block.

<AccordionGroup>
  <Accordion title="Example WAF rule IDs">
    | Rule ID       | Category              | What it matches                                       |
    | ------------- | --------------------- | ----------------------------------------------------- |
    | `WAF-SQLI-01` | SQL injection         | Classic `' OR 1=1` and boolean-based payloads         |
    | `WAF-SQLI-02` | SQL injection         | UNION SELECT extraction attempts                      |
    | `WAF-SQLI-03` | SQL injection         | Time-based blind injection (`SLEEP`, `WAITFOR`)       |
    | `WAF-XSS-01`  | Cross-site scripting  | `<script>` tag injection and event handler attributes |
    | `WAF-XSS-02`  | Cross-site scripting  | JavaScript URI schemes and data URIs                  |
    | `WAF-RCE-01`  | Remote code execution | Shell metacharacters and command separators           |
    | `WAF-PT-01`   | Path traversal        | `../` sequences and URL-encoded equivalents           |
    | `WAF-SSTI-01` | Template injection    | Template expression syntax for common engines         |

    The triggered rule ID appears in the **Threat Feed** and **Audit Logs** for every blocked request.
  </Accordion>

  <Accordion title="How rule matching works">
    Recon44 normalizes each request before matching — decoding URL encoding, HTML entities, and common obfuscation patterns. This ensures attackers cannot bypass rules by encoding their payloads.

    Matching runs in parallel across all rule categories. If any rule fires, the WAF acts according to your plan's configured mode before the request continues.
  </Accordion>
</AccordionGroup>

## Inspection latency

<Note>
  Average WAF inspection latency is **47ms**. This is the time added to a request for full rule evaluation — Recon44 adds no perceptible delay to legitimate users.
</Note>

Inspection happens at edge nodes geographically close to your visitors. The request is evaluated in-flight; your origin server only receives requests that have already cleared the WAF.

## WAF modes by plan

Your WAF operates in one of two modes depending on your plan.

<Tabs>
  <Tab title="Free plan — Log only">
    On the Free plan, the WAF runs in **read-only mode**:

    * Every request is inspected against the full rule set.
    * Matching requests are **logged** and visible in your Threat Feed.
    * No traffic is blocked — requests pass through to your origin.

    Use this mode to understand your attack surface before upgrading to active blocking.

    <Info>
      You can still manually block specific IPs from the dashboard on the Free plan. WAF auto-blocking requires Pro or above.
    </Info>
  </Tab>

  <Tab title="Pro and above — Active blocking">
    On Pro, Business, Scale, and Enterprise plans, the WAF runs in **active blocking mode**:

    * Requests that match exploit patterns are **blocked at the edge** — they never reach your origin server.
    * The source IP is automatically added to the block list.
    * Blocked requests appear in your Threat Feed with the action `blocked` and the rule ID that matched.

    <Tip>
      You can temporarily switch any site to Log Only mode from **Settings → WAF** if you need to debug a false positive without disabling protection entirely.
    </Tip>
  </Tab>
</Tabs>

## Handling false positives

If the WAF blocks legitimate traffic, you have two options:

<Steps>
  <Step title="Check the Threat Feed">
    Open your dashboard and find the blocked request. The entry shows the source IP, the matched rule ID, and the full request path.
  </Step>

  <Step title="Whitelist the IP">
    If the blocked IP belongs to a trusted source (a monitoring service, your own office, a payment provider), click **Whitelist** next to the entry. Whitelisted IPs bypass WAF inspection entirely.
  </Step>

  <Step title="Report a false positive">
    If you believe a rule is incorrectly matching legitimate traffic, use the **Report false positive** option on the blocked entry. This sends the rule ID and anonymized request data to the Recon44 rule team for review.
  </Step>
</Steps>

<Warning>
  Whitelisting an IP disables all WAF inspection for traffic from that address. Only whitelist IPs you fully control or trust.
</Warning>

## Related pages

<CardGroup cols={2}>
  <Card title="Live Threat Feed" icon="chart-line" href="/concepts/threat-feed">
    See every WAF event in real time, including the rule ID and action taken.
  </Card>

  <Card title="IP Blocking" icon="ban" href="/concepts/ip-blocking">
    Manage automatic and manual IP blocks, whitelists, and geo rules.
  </Card>
</CardGroup>