This section describes how to configure web tamper protection (WTP) rules.
You can configure these rules to prevent a static webpage from being tampered with.
WTP has the following advantages:
- Quicker response to requests
After a WTP rule is configured, WAF caches the static webpage on the server. When receiving a request from a web visitor, WAF returns the cached page to the visitor.
- Web tamper protection
If an attacker modifies a static webpage on the server, WAF returns the cached original webpage to web visitors, ensuring that visitors never access tampered-with pages.
WAF can randomly extract a request from a web visitor to compare the requested page with the webpage on the server. If WAF detects that the page has been tampered with, it notifies the user by SMS or email. For details about alarm notification settings, see Enabling Alarm Notification.
- Login credentials have been obtained.
- The domain name to be protected has been created.
- Log in to the management console.
- Click in the upper left corner of the management console and select a region or project.
- Choose Domains. The Domains page is displayed (see Figure 1).. In the navigation pane, choose
Figure 1 Domains page
- In the Operation column of the row containing the target domain name, click Configure Policy. The protection configuration page is displayed, as shown in Figure 2.
Figure 2 Protection configuration page
- In the Web Tamper Protection configuration area, change Status as needed and then click Save in the upper right corner of the Protection Status list. In the dialog box displayed, click Yes to save the settings. Otherwise, click Cancel. See Figure 3.
Figure 3 Web Tamper Protection configuration area
- Click Customize Rule. On the displayed page, click Add Rule in the upper left corner to add a web tamper protection rule. See Figure 4.
If you do not click Save after changing Status in step 5, the Warning dialog box is displayed when you click Customize Rule.
- Click Yes to cancel the previous settings.
- Click No and then Save to save the settings.
Figure 4 Clicking Add Rule
- In the displayed dialog box shown in Figure 5, specify the parameters by referring to Table 1.
Figure 5 Adding a web tamper protection rule
Table 1 Rule parameters
Domain name to be protected
URL excluding a domain name
- The path does not support regular expressions.
- The path cannot contain two or more consecutive slashes. For example, ///admin. If you enter ///admin, the WAF engine converts /// to /.
For example, if the URL to be protected is http://www.example.com/admin, set Path to /admin.
- Click OK.
- In the event of changes on the protected webpage, WAF needs to re-cache the webpage content. In this case, click Update Cache in the row containing the target rule.
- To delete the added rule, click Delete in the row containing the target rule.