Overview
Protection is not an isolated switch. WAFGO considers onboarding scope, legitimate traffic, incident handling and post-incident review as one process, with clear responsibilities for the application team.
From detection to recovery review
Protection should make it possible to explain when an anomaly was detected, what action followed and whether legitimate service recovered. Blocked traffic alone cannot describe the outcome.
Detection
Examine connections, requests and bandwidth changes while distinguishing legitimate demand surges from suspected abuse.
Filtering and routing
Apply controls within the agreed protocol and protection scope while monitoring successful legitimate access.
Recovery and review
Record policy changes, business impact and recovery, then review bypass routes and exposed services.
Distinguish network and application protection
Bandwidth or connection exhaustion differs from frequent requests to expensive application endpoints such as login or search. They should not receive identical treatment.
| Risk | Assessment focus |
|---|---|
| Network or transport pressure | Protocols, onboarding method, connection patterns and actual coverage |
| Application request pressure | Endpoint cost, identity context, rate controls and false positives |
| Origin bypass | Origin exposure, access restrictions and alternate entry points |
| Malicious uploads and input | Application validation, file handling and WAF coordination; content moderation is not assumed |
Prepare usable incident information
Document expected peaks, legitimate traffic patterns and contact channels before an incident. Keep event records and request samples limited to what is needed.
- List protected hostnames, protocols, origins and business journeys, including entry points outside the protection path.
- Agree on alert recipients, escalation channels and people authorized to roll back policies.
- Preserve time windows, error samples and changes, removing cookies, tokens and other sensitive data before sharing.
Implementation & checks
- 01
Confirm scope
Agree on protected entry points, protocols and origin requirements.
- 02
Establish a baseline
Record normal and event-driven legitimate traffic.
- 03
Rehearse recovery
Test notifications, policy rollback and recovery checks.