Docs

Stopping XSS, CSRF, SQL injection, and Framework Attacks

Attack Blocking Is Automatic

Attacks like SQL injection and cross-site scripting follow recognizable patterns, and the WAF inspects every request for them before traffic reaches your application. This protection is enabled when your WAF is provisioned and stays on. There is no setting to turn on and nothing to configure.

What Gets Blocked

Attack What the WAF does
SQL injection Drops requests carrying SQL syntax aimed at your database, including encoded and obfuscated variants. See SQL Injection.
Cross-site scripting (XSS) Drops requests carrying script payloads aimed at your visitors’ browsers. See Cross Site Scripting.
Framework and CMS exploits When a vulnerability in a common framework or library is disclosed, blocking rules for its exploit are deployed at the edge, usually before most applications have upgraded. Requests matching known exploits are blocked even if you have not patched yet.
Command execution and file inclusion Blocks attempts to run system commands or make your server fetch and execute remote files. See Remote Command Execution and Remote File Inclusion.

Blocked requests appear in the Block Logs page of your dashboard with a block code explaining what was caught. If a legitimate request is being blocked, see Troubleshooting 403 WAF Blocks.

What About CSRF?

Cross-site request forgery works differently from the attacks above. A forged request comes from a real user’s browser and looks legitimate on the wire, so the defense lives in your application: CSRF tokens and SameSite cookie settings, which most frameworks (Rails, Django, Laravel) enable by default.

The WAF still helps here by blocking the cross-site scripting that attackers use to steal CSRF tokens, but it cannot validate your application’s tokens for you. Keep your framework’s CSRF protection on.

Optional Hardening

Beyond the automatic protection, the Content Security page of your WAF dashboard offers controls you can enable:

  • HTML in Form Submissions: block visitors from submitting HTML or script content through your forms. See Blocking HTML in Forms.
  • Force Security Headers: add X-XSS-Protection, X-Frame-Options, and X-Content-Type-Options to your responses. See Managing HTTP Security Headers.
  • Referrer-Policy: control how much referrer information browsers send with outbound requests.

For a full tour of the blocking layers, see How WAF Blocking Works.

Need Help?