Web firewall
How the InfraFence web firewall scores every visitor from the access logs - attack types and points, decay, action levels, rate rules, custom rules and where the logs come from.
Last updated:
The web firewall reads your web servers' access logs, gives each visitor address a score, and bans the address at the firewall when the score gets high enough. It works with any web server that writes an access log, needs no change to its configuration, and adds no latency to requests.
Where the logs come from
The agent finds the access logs by itself, in this order:
WEB_LOG_PATH, if set (it then replaces detection);- nginx and Apache configuration (
access_log,CustomLog), OpenLiteSpeed virtual hosts, cPanel domlogs; - web containers on the host (see Docker);
- the per-domain logs of Plesk, ISPConfig, DirectAdmin, CyberPanel and others, and the usual paths of nginx, Apache, LiteSpeed and Caddy.
It looks again every 5 minutes, so new sites are picked up. Requests for static files (CSS, JavaScript, images, fonts) are not scored, and private addresses are skipped.
Attack types and points
| Attack type | Points |
|---|---|
| Remote code execution, web shell, Shellshock, scanner user agent | 50 |
| SQL injection, SSRF, web exploit, honeypot | 40 |
| Path traversal, header injection, WordPress or CMS brute force | 30 |
XSS, .env probe, XML-RPC abuse |
25 |
| Configuration probing | 20 |
| 404 flood | 15 |
Scanner user agents include sqlmap, nikto, nmap, masscan, wpscan, gobuster, nuclei, acunetix and nessus. The full built-in catalog, 109 patterns, is published with each release as waf-catalog.json, and the Web firewall page lists every pattern the agent applies.
Rate rules
Some attacks are a matter of volume. These rules add their points when an address exceeds the threshold within the window:
| Rule | Default threshold | Window |
|---|---|---|
| WordPress login | 10 | 2 minutes |
WordPress admin-ajax.php without a session |
10 | 30 seconds |
| XML-RPC | 5 | 1 minute |
| Drupal login, Joomla login | 5 | 30 seconds |
| Plugin scanning | 5 | 5 minutes |
| 404 flood | 15 | 5 minutes |
Score and actions
Scores decay by 5 points a minute, so a single odd request fades away. The score decides the level:
| Score | Level | What happens |
|---|---|---|
| 30 | observe | Reported as an informational event. |
| 60 | throttle | Reported as a warning. |
| 80 | block | Banned at the firewall, reported as critical. |
| 100 | firewall ban | Banned at the firewall, reported as critical. |
A ban lasts as Settings › Agent › Ban duration says, like an SSH ban. An address that ModSecurity has already reported is not scored a second time.
Change the rules
On the Web firewall page (owners and admins; members can read it):
- per attack type: the Points, a Threshold for the rate rules, and the mode: Active, Detect only (reported, never banned) or Off;
- Built-in patterns: turn off single patterns that cause false positives;
- Custom rules: a plain-text or regular-expression pattern matched against the URL, the User-Agent or the Referer, scored as an attack type you choose. A decoy path scored as honeypot traps scanners. Regular expressions use RE2 syntax, case-insensitive, and the Test against box tries a pattern before you save it.
Save WAF settings sends the changes; servers apply them within seconds.
Monitor mode
With Monitor mode on, every type is detect-only: scores and events continue, nothing is banned.
For blocking inside the web server, on the first request, see ModSecurity.