Protect a website with the WAF

A web application firewall (WAF) checks each request to a website before the request reaches your origin, and refuses requests that look like attacks. Coritan's WAF runs at the edge, and each web proxy has it on or off. A website's WAF tab lists every web proxy under the domain, such as example.com and www.example.com, with its WAF, Force HTTPS and Development mode switches. The web application firewall explains what the WAF checks and what visitors see when it refuses a request.

• Each name you want to protect needs a web proxy (Manage a website's web proxy or Create a web proxy).
• The WAF only sees traffic that comes through Coritan's edge, so each name must resolve to the edge (Web proxies and DNS records).

1. In the dashboard, go to Websites, open the domain and select the WAF tab.
2. Find the web proxy on the Routes under this domain card. The Route column shows its name, and where it forwards to under the name.
3. Switch WAF on or off in its row. The badge beside the switch shows Protected or Off.

Switch Force HTTPS on in the web proxy's row. Visitors who open an http:// address are redirected to the same address over https://.

1. Choose how long development mode lasts in Development mode window: 1 hour, 3 hours, 12 hours, 24 hours or Until switched off. The list starts at 3 hours.
2. Switch Development mode on in the web proxy's row. The text beside the switch shows the time left, such as On for 3 more h, or On until switched off.

Development mode shows the origin's address and the connection failure on the edge's error pages. The WAF keeps checking requests while it is on. Use development mode while you debug explains what it shows and when it ends.

Each change shows a confirmation, such as WAF updated for www.example.com., and the row shows the new state. The Protection column in Edge Proxy shows the same switches as WAF, HTTPS and Dev mode badges.

The tab says No routes yet

The domain has no web proxy on your account. Select Connect to a server to send the domain to one of your servers, or Add web proxy to forward it to any origin.

A name that goes through the edge is not listed

The tab lists the web proxies on your account under the domain. A name that goes through the edge only because of a proxied A or AAAA record has no web proxy on your account, and always has the WAF on.

Visitors see The web application firewall blocked your request to protect this website from traffic that looks malicious.

A request matched enough rules for the WAF to refuse it with 403. You cannot change the rules or exempt a path. If the WAF refuses real visitors, turn it off for that web proxy and contact support with the address and the time of a refused request.

Visitors see Confirm you are not a bot to continue to example.com.

The WAF found the request suspicious but not bad enough to refuse, and asks the visitor to prove they are human. A browser continues after the check. Scripts and other clients that are not browsers cannot pass it.

• How web proxies work
• Change a web proxy's settings
• Manage a website's web proxy

Each switch is a field of the web proxy: waf_enabled, force_https and development_mode. Change one with PATCH /api/v1/proxy/routes/{route_id}, sending only the fields to change:

curl -X PATCH https://api.coritan.com/api/v1/proxy/routes/31 \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"waf_enabled": true, "force_https": true}'

The answer is {"message": "Route updated"}. To turn on development mode, send development_mode as true with development_mode_minutes, from 0 to 1440. 0 keeps it on until you turn it off, and leaving the field out gives 180 minutes. A body with no fields answers 400 with No fields to update. Change a web proxy's origin lists every field the call takes.