About the Fastly WAF rule management interface (2020)


As announced, April 30, 2023 marks the formal retirement of the Fastly WAF (WAF Legacy and WAF 2020). Our Fastly Next-Gen WAF offers similar functionality. It monitors for suspicious and anomalous web traffic and protects, in real-time, against attacks directed at the applications and origin servers that you specify.

The Fastly WAF rule management interface provides visibility and management for rules enabled on a WAF associated with a Fastly service. If you've been assigned the role of engineer or superuser, you can use the rule management interface to inspect the details of WAF rules, search and filter by rule ID or category, manage thresholds and scores, change rule modes, and deploy changes into production.

Accessing the Fastly WAF rule management interface

You can access the Fastly WAF rule management interface from the WAF dashboard. To access the Fastly WAF rule management interface, follow the steps below:

  1. Log in to the Fastly web interface. The Home page appears displaying a list of all services associated with your account.
  2. Find your Fastly service in the list and then click WAF. The WAF summary page appears.

  3. Click Manage Rules. The Manage rules page appears.

    the Manage rules page

About rules

The Fastly WAF rule management interface displays the rules currently enabled on the WAF associated with the selected Fastly service. If you haven't enabled rules or you don't see any rules on your WAF, contact support.

There are three types of rules: scoring rules, threshold rules, and application-specific rules. The revision indicator is used to indicate whether or not a rule has been revised. A revised rule may provide additional protection over and above the earlier revision.

Scoring rules

Scoring rules increment a score based on anomalies detected in the incoming HTTP request. An example scoring rule is shown below.

the WAF scoring rule

Fastly sets default anomaly scores for four categories of rules. When an HTTP request trips a rule in a category, that numeric value is added to the total score for that category. The sum of all the rules' scores is the anomaly score for the HTTP request. For example, if an HTTP request trips a critical rule and an error rule, and the critical anomaly score is set to 6 and the error anomaly score is set to 5, the score for the HTTP request would be 11.

Scoring rules have two possible modes:

  • Scoring: This mode means a rule is active and looking for threats. Rules in this mode will increment scores and log their result to your currently configured logging provider based on the setting for the corresponding threshold rule. For more information on threshold rules, see the section on threshold rules.
  • Disabled: This mode means a rule is inactive. Threats detected by this rule will not count towards your total anomaly score and their result will not be logged.

You can click Details to see the format of a rule in the Apache ModSecurity format as well as the corresponding generated VCL.


The generated VCL shows a general transformation from the Apache ModSecurity language to VCL. The VCL shown here does not show how a rule increments your anomaly score based on your configured values.

Threshold rules

Threshold rules cover a specific category of attack against your web application or API. These rules check the total score (as calculated by scoring rules) against the value configured for the appropriate threshold. An example threshold rule is shown below.

the WAF threshold rule

The threshold rule has a category name, revision indicator, tag, rule ID, mode selector, and Details.

Threshold rules perform an action and either log or block and log client HTTP requests. These rules take action when a score exceeds a given threshold value. The corresponding threshold value for each category is configured on the Settings page.

Lowering thresholds increases the sensitivity of your WAF. Raising thresholds reduces the sensitivity of your WAF across the various threshold categories.

The Fastly WAF includes the following threshold rules organized into categories. Each rule has a corresponding threshold value that controls its sensitivity.

IDThreshold NameRule Action ConditionCorresponding Threshold ValueAction Choice
1010090Inbound Anomaly ScoreAction taken when the inbound anomaly score exceeds the configured inbound anomaly thresholdInbound anomaly thresholdLog or Block & Log
1010080Session FixationAction taken when the session fixation score exceeds the configured session fixation thresholdSession fixation thresholdLog or Block & Log
1010070HTTP ViolationAction taken when the HTTP violation score exceeds the configured HTTP violation thresholdHTTP violation thresholdLog or Block & Log
1010060PHP InjectionAction taken when the PHP injection score exceeds the configured PHP injection thresholdPHP injection thresholdLog or Block & Log
1010050Remote Command Execution (RCE)Action taken when the RCE anomaly score exceeds the configured RCE thresholdRCE thresholdLog or Block & Log
1010040Local File Inclusion (LFI)Action taken when the LFI score exceeds the configured LFI thresholdLFI thresholdLog or Block & Log
1010030Remote File Inclusion (RFI)Action taken when the RFI score exceeds the configured RFI thresholdRFI thresholdLog or Block & Log
1010020Cross-site Scripting (XSS)Action taken when the XSS score exceeds the configured XSS thresholdXSS thresholdLog or Block & Log
1010010SQL InjectionAction taken when the SQL injection score exceeds the configured SQL injection thresholdSQL injection thresholdLog or Block & Log

Disabling a threshold rule removes an entire category of protection from your WAF. Use caution when disabling threshold rules.

Application-specific rules

Application-specific rules look at incoming HTTP requests to find signatures designed to take advantage of specific vulnerabilities within the context of a specific library, framework, or component. They take effect immediately. Application-specific rules have three possible modes:

  • Logging Mode: This mode means a rule is active and looking for threats. Rules in this mode will log their result on an exact match. The result is logged to your currently configured logging provider.
  • Blocking Mode: This mode means a rule is active and looking for threats. Rules in this mode block the HTTP request and prevent it from going to the origin. Rules in blocking mode also log the result to your currently configured logging provider.
  • Disabled: This mode means a rule is inactive. HTTP requests that match a rule will flow directly to your origin.

Searching for rules

The rule search box allows you to search for a specific rule using the rule ID or keyword. The result is shown in the rule view.

Keyword search allows you to search for rules that contain a specific query string in the rule source. For example, you can search for rules that contain keywords such as java, php, loic, or ddos. Keyword search compares your query string against the rule's mod_security source.

You can control the scope of the search through the use of the Include all and Exclude applied filters. Selecting Include all expands the search to the entire rule library as well as the rules currently active on your WAF. Selecting Exclude applied searches only the rules in the library that are not currently active on your WAF.

the WAF rule search

Filtering rules by category

The category filters allow you to view the different types of rules currently configured on your WAF. Filters can be combined.

  • Status filter: Allows you to filter by rule mode for log, block, or disabled.
  • Publisher filter: Allows you to filter by rule publisher. Currently supported publishers include OWASP, Trustwave, and Fastly.

    Use the Publisher filter and select OWASP to show all rules in scoring mode.

  • Attack type filter: Allows you to show the rules enabled on your WAF that offer protection for specific categories of attack.

Adding new rules to your WAF

You may want to add new rules to your WAF based on changing attack patterns and risks to your application. You can add new rules by using the scope filters displayed under the search box to browse, search, and select new rules. Selecting the Include all filter will display all rules in the current rule library in the rule view.


By selecting Include all, you will see considerably more rules than you have currently active. Pagination allows you to browse through the rule base.

Once the rules are available to browse, you can use the search box to search for a specific rule ID or keyword. For example, if you're interested in protecting against Apache Struts2 vulnerabilities published in CVE-2017-9805, you might search for struts2 or RCE.

the WAF rule search with Include all selected

The rule view will appear as follows.

the WAF rule view results

You can view the rule source by selecting Details. This provides you with more information about how the rule executes in VCL.

You can enable a rule by selecting Options and changing the mode to either Log or Block.


The available options for OWASP rules are Scoring and Disabled. To enable a new OWASP rule, select Scoring.

Verifying a rule is active

After you select the rule mode, the rule appears at the top of the rule view. To verify that your rule was added, you should deselect the Include all filter and use the Status, Publisher, or Attack type filters and confirm that the rule has been added to your WAF.

After you verify that the rule has been added, follow the instructions in the activating changes section to activate your changes.

Activating changes

The Fastly WAF rule management interface allows you to change rule modes and threshold values that change the way rules behave in the face of potential web-oriented attacks. After changing rule modes, you can click Activate to put these changes into production.

activate button for the Fastly WAF

After clicking Activate, you'll see a confirmation message asking if you want to activate your changes. Click Yes to continue.


Changes to your WAF are applied only after you click Activate.

WAF policy execution

When the Fastly WAF processes an inbound request, scoring rules execute first followed by threshold rules. Application-specific and Fastly rules are executed last.

If the accumulated score exceeds the configured threshold, the threshold rules take action. For more information on the threshold categories and action condition, please see the table in the threshold rules section.

the WAF process

Was this guide helpful?

Do not use this form to send sensitive information. If you need assistance, contact support. This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.