Bots are hitting your website right now. Stop them at the door.

The attackBotnets replay millions of leaked username/password pairs, or guess passwords, against your login and password-reset endpoints at thousands of attempts per minute. One reused password is enough to take over an account.

How WAP stops itAdd a rate-limit rule on the sensitive path, e.g. /login at 10 requests per minute per client IP. Every attempt over the limit is answered with 429 at the edge, so your authentication backend and database never see it.

The attackLayer-7 floods send cheap HTTP requests that are expensive for you: search queries, report generation, cart operations. Aggressive scrapers do the same to copy prices and content. Both exhaust CPU, database connections and bandwidth.

How WAP stops itA site-wide per-IP requests-per-minute ceiling caps every visitor. Offending networks can be blocked by CIDR, and changes reach every edge node's memory within seconds. Volumetric L3/L4 DDoS needs network-level scrubbing upstream of WAP.

The attackAutomated scanners request well-known paths on every site they find: /.env with database passwords, /.git/config, /wp-admin, /phpmyadmin, /actuator, /server-status. One forgotten file can leak credentials or source code.

How WAP stops itBlock rules on a path prefix, exact path or substring stop these requests with 403 before they reach the origin. To keep an admin panel reachable from your office only, add an allow rule for your office IP range and a block rule for the path.

The attack../ sequences in the URL escape the web root to read files such as /etc/passwd or application configs. Attackers percent-encode them (%2e%2e%2f), double-encode them (%252e) or use backslashes to slip past naive filters.

How WAP stops itWAP decodes every path repeatedly, so double and triple encoding are unwrapped, and treats backslashes as separators. Any request whose path still contains a .. segment is rejected. Real browsers resolve these segments before sending, so legitimate traffic never trips this check.

The attackPath filters are often bypassed by writing the same URL differently: /%61dmin, //admin, /ADMIN, /public/../admin or \admin. The origin server normalises the path and serves the protected page anyway.

How WAP stops itBefore matching rules, WAP normalises every path: it percent-decodes, collapses duplicate slashes, resolves dot segments, converts backslashes and ignores case. One /admin rule covers every spelling, while the original URL is still forwarded unchanged to your origin.

The attackTools such as sqlmap, nikto, nuclei and masscan map your application and probe for known CVEs, often hours after a vulnerability is published. Their requests also fill your logs with noise.

How WAP stops itUser-Agent rules block known tooling, and IP/CIDR rules block hostile networks. Because the User-Agent is chosen by the client, combine these rules with rate limits. Blocked requests are counted per site per day on your dashboard.

The attackAttackers send their own X-Forwarded-For or X-Real-IP header to look like an allow-listed address, to escape per-IP rate limits, or to plant a fake IP in your logs and audit trail.

How WAP stops itWAP discards every forwarding header the client sends and writes X-Forwarded-For and X-Real-IP from the actual TCP connection. Rate limits and IP rules use that same verified address.

The attackIf attackers find your origin's real IP address, through old DNS records, certificate logs or a mail header, they can go around any proxy and attack the server directly.

How WAP stops itEvery request WAP forwards carries the fingerprint header X-WAP: secure. Allow only the WAP edge in your origin firewall and reject requests that don't carry the header. Direct hits then fail even when the IP has leaked.

The attackAmbiguous framing, such as Content-Length and Transfer-Encoding in the same request, makes the proxy and the origin disagree about where one request ends. A hidden second request is smuggled past security checks or into another user's connection.

How WAP stops itWAP fully parses each request and re-frames it for the upstream connection. When Transfer-Encoding is present, Content-Length is dropped, and hop-by-hop headers, including any listed in Connection, are stripped. The origin only receives framing that WAP generated.

The attackTRACE reflects the full request back, which can expose cookies and authorization headers (cross-site tracing). PUT, DELETE or PATCH left enabled by mistake can let attackers modify content.

How WAP stops itTRACE and TRACK are blocked for every site. Method rules can block any other verb your application doesn't use, for example DELETE on a marketing site.

The attackVery large request bodies fill memory and disk on upload handlers. An origin that hangs ties up connections until nothing is left for real users.

How WAP stops itBodies over the platform limit (25 MB by default) are refused with 413. The limit is checked against the declared Content-Length and again while the body streams. Upstream connect and response timeouts end hung connections with 504.

The attackForged Host or X-Forwarded-Host headers poison caches and password-reset links. Attackers also try to use reverse proxies as open relays to reach arbitrary sites.

How WAP stops itOnly exact, registered host names are forwarded, to the origin their owner configured. Every other host gets 401 and is never proxied. X-Forwarded-Host is always set by WAP, never taken from the client.