• Web Application Firewall

waf
  1. Help Center
  2. Web Application Firewall
  3. User Guide
  4. Rule Configurations
  5. Configuring Web Tamper Protection Rules

Configuring Web Tamper Protection Rules

This section describes how to configure web tamper protection (WTP) rules.

You can configure these rules to prevent a static webpage from being tampered with.

WTP has the following advantages:

  • Quicker response to requests

    After a WTP rule is configured, WAF caches the static webpage on the server. When receiving a request from a web visitor, WAF returns the cached page to the visitor.

  • Web tamper protection

    If an attacker modifies a static webpage on the server, WAF returns the cached original webpage to web visitors, ensuring that visitors never access tampered-with pages.

    WAF can randomly extract a request from a web visitor to compare the requested page with the webpage on the server. If WAF detects that the page has been tampered with, it notifies the user by SMS or email. For details about alarm notification settings, see Enabling Alarm Notification.

Prerequisites

  • Login credentials have been obtained.
  • The domain name to be protected has been created.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner of the management console and select a region or project.
  3. Choose Security > Web Application Firewall. In the navigation pane, choose Domains. The Domains page is displayed (see Figure 1).

    Figure 1 Domains page

  4. In the Operation column of the row containing the target domain name, click Configure Policy. The protection configuration page is displayed, as shown in Figure 2.

    Figure 2 Protection configuration page

  5. In the Web Tamper Protection configuration area, change Status as needed and then click Save in the upper right corner of the Protection Status list. In the dialog box displayed, click Yes to save the settings. Otherwise, click Cancel. See Figure 3.

    Figure 3 Web Tamper Protection configuration area

  6. Click Customize Rule. On the displayed page, click Add Rule in the upper left corner to add a web tamper protection rule. See Figure 4.

    NOTE:

    If you do not click Save after changing Status in step 5, the Warning dialog box is displayed when you click Customize Rule.

    • Click Yes to cancel the previous settings.
    • Click No and then Save to save the settings.
    Figure 4 Clicking Add Rule

  7. In the displayed dialog box shown in Figure 5, specify the parameters by referring to Table 1.

    Figure 5 Adding a web tamper protection rule
    Table 1 Rule parameters

    Parameter

    Description

    Example Value

    Domain Name

    Domain name to be protected

    www.example.com

    Path

    URL excluding a domain name

    NOTE:
    • The path does not support regular expressions.
    • The path cannot contain two or more consecutive slashes. For example, ///admin. If you enter ///admin, the WAF engine converts /// to /.

    /admin

    For example, if the URL to be protected is http://www.example.com/admin, set Path to /admin.

  8. Click OK.

    • In the event of changes on the protected webpage, WAF needs to re-cache the webpage content. In this case, click Update Cache in the row containing the target rule.
    • To delete the added rule, click Delete in the row containing the target rule.