# Protect a website with the WAF

> Turn the web application firewall, HTTPS redirects and development mode on or off for each web proxy under a domain.

Source: https://www.coritan.com/docs/websites/waf/

In the dashboard:

- /dashboard/websites/…/waf: https://www.coritan.com/dashboard/websites
- /security/waf: https://www.coritan.com/security/waf

A web application firewall (WAF) checks each request to a website before the request reaches your origin, and refuses requests that look like attacks. Coritan's WAF runs at the edge, and each web proxy has it on or off. A website's **WAF** tab lists every web proxy under the domain, such as `example.com` and `www.example.com`, with its WAF, **Force HTTPS** and **Development mode** switches. [The web application firewall](/docs/proxies/web-proxies/#the-web-application-firewall) explains what the WAF checks and what visitors see when it refuses a request.

## Before you begin

- Each name you want to protect needs a web proxy ([Manage a website's web proxy](/docs/websites/proxy/) or [Create a web proxy](/docs/proxies/web-proxies/create-a-web-proxy/)).
- The WAF only sees traffic that comes through Coritan's edge, so each name must resolve to the edge ([Web proxies and DNS records](/docs/proxies/web-proxies/#web-proxies-and-dns-records)).

## Turn the WAF on or off

1. In the dashboard, go to [Websites](https://www.coritan.com/dashboard/websites), open the domain and select the **WAF** tab.
2. Find the web proxy on the **Routes under this domain** card. The **Route** column shows its name, and where it forwards to under the name.
3. Switch **WAF** on or off in its row. The badge beside the switch shows **Protected** or **Off**.

## Send visitors to HTTPS

Switch **Force HTTPS** on in the web proxy's row. Visitors who open an `http://` address are redirected to the same address over `https://`.

## Turn on development mode while you debug

1. Choose how long development mode lasts in **Development mode window**: **1 hour**, **3 hours**, **12 hours**, **24 hours** or **Until switched off**. The list starts at **3 hours**.
2. Switch **Development mode** on in the web proxy's row. The text beside the switch shows the time left, such as `On for 3 more h`, or **On until switched off**.

Development mode shows the origin's address and the connection failure on the edge's error pages. The WAF keeps checking requests while it is on. [Use development mode while you debug](/docs/proxies/web-proxies/settings/#use-development-mode-while-you-debug) explains what it shows and when it ends.

## Result

Each change shows a confirmation, such as `WAF updated for www.example.com.`, and the row shows the new state. The **Protection** column in [Edge Proxy](https://www.coritan.com/dashboard/proxies/web) shows the same switches as **WAF**, **HTTPS** and **Dev mode** badges.

## Troubleshooting

The tab says **No routes yet**
: The domain has no web proxy on your account. Select **Connect to a server** to send the domain to one of your servers, or **Add web proxy** to forward it to any origin.

A name that goes through the edge is not listed
: The tab lists the web proxies on your account under the domain. A name that goes through the edge only because of a proxied `A` or `AAAA` record has no web proxy on your account, and always has the WAF on.

Visitors see `The web application firewall blocked your request to protect this website from traffic that looks malicious.`
: A request matched enough rules for the WAF to refuse it with `403`. You cannot change the rules or exempt a path. If the WAF refuses real visitors, turn it off for that web proxy and [contact support](/docs/support/) with the address and the time of a refused request.

Visitors see `Confirm you are not a bot to continue to example.com.`
: The WAF found the request suspicious but not bad enough to refuse, and asks the visitor to prove they are human. A browser continues after the check. Scripts and other clients that are not browsers cannot pass it.

## Related

- [How web proxies work](/docs/proxies/web-proxies/)
- [Change a web proxy's settings](/docs/proxies/web-proxies/settings/)
- [Manage a website's web proxy](/docs/websites/proxy/)

## With the API

Each switch is a field of the web proxy: `waf_enabled`, `force_https` and `development_mode`. Change one with `PATCH /api/v1/proxy/routes/{route_id}`, sending only the fields to change:

```bash
curl -X PATCH https://api.coritan.com/api/v1/proxy/routes/31 \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"waf_enabled": true, "force_https": true}'
```

The answer is `{"message": "Route updated"}`. To turn on development mode, send `development_mode` as `true` with `development_mode_minutes`, from `0` to `1440`. `0` keeps it on until you turn it off, and leaving the field out gives 180 minutes. A body with no fields answers `400` with `No fields to update`. [Change a web proxy's origin](/docs/proxies/web-proxies/change-the-origin/#with-the-api) lists every field the call takes.