WAF Setup

Protect web applications with Web Application Firewalls.

Prerequisites

• Web application behind a load balancer or reverse proxy
• AWS account for AWS WAF, or Cloudflare account for Cloudflare WAF
• Nginx with ModSecurity module compiled for self-hosted WAF
• Access to application logs to tune rules and identify false positives
• Understanding of HTTP request/response structure

Before mutation, verify the owned account/zone/resource, existing rules and rollback plan. Save current configuration; creating duplicate phase entrypoints or applying Terraform can replace rules. Test the actual application in staging with representative allowed and disallowed requests, then promote a narrowly scoped blocking policy. The blocking examples below are desired enforcement states, not a recommendation to enable all rules immediately. Review sampled-request/log retention and redact tokens, cookies and bodies. WAFs do not replace application authorization, CSRF defenses, parameterized queries or dependency fixes.

AWS WAF

Create Web ACL with Managed Rules