Skip to main content

General settings

Web Application Firewall

Core Rule Set Version​

The Core Rule Set (CRS) contains the attack detection rules that power the Threat Protection Web Application Firewall (WAF).

Use the Core Rule Set Version dropdown to select the active CRS version for your Traffic Configuration. You have two main options when selecting a version:

  • Fixed version: Pin your configuration to an exact CRS version (e.g., 4.9.0).
  • Automated Upgrade Version: Opt into automatic updates by selecting a wildcard version (for example, 4.*.* or 4.25.*). This ensures your setup automatically tracks the latest releases within a specific major or minor version range.

CRS dropdown

Figure 1: CRS dropdown

Note: Automatic updates are strongly recommended. They ensure traffic configurations stay up to date with the latest CRS security protections and improvements. Keep in mind that applying a new CRS version may require additional tuning for your application.

Paranoia Level​

The Threat Protection WAF offers different paranoia levels (from 1 to 4), each providing an increasing number of security checks and rules. Level 1 is the least stringent, requiring less tuning. Level 4 is the most stringent, potentially requiring more tuning to avoid false positives. For more details on the Paranoia Level, see How WAF Works

Paranoia levels

There are four paranoia levels available, ranging from 1 to 4. At level 4, traffic is subject to the most comprehensive set of rules, pre-processors, and HTTP compliance checks, among other stringent security measures.

The paranoia levels correspond to the rule set, where more aggressive rules offer greater security but increase the likelihood of false positives. At level 1, the risk of false positives is typically lower, requiring less tuning compared to higher levels.

Source CIDR Exclusions​

By specifying them here, you can exclude one or more IPs or networks from WAF inspection. To exempt specific networks from WAF rules, add their IP address using CIDR notation, such as /32 (for a single host) or /24 subnets.