PRODUCTS / WEB APPLICATION FIREWALL

Web application firewall

Per-domain Web ACLs, managed OWASP-aligned rule groups, custom rules, request normalization, reputation labels, challenge flows and response inspection — all before malicious traffic reaches your application.

Per-domain protection

Every hostname gets its own Web ACL.

Enable or disable inspection, set a default allow or block posture, and stack rule groups in priority order. Malicious traffic is stopped before it reaches your application.

Inspect

per hostname

Stack

priority rules

Stop

before origin

Full request inspection

Evaluate incoming requests before they hit your app. Block attacks at the door.

Full response inspection

Evaluate outgoing responses separately. Catch data leaks, error disclosures, and malware markers before they reach users.

OWASP Top 10–aligned managed rule groups

Turn on CrownWall-maintained rule packs mapped to common OWASP Top 10 categories — no signature tuning required.

SQL injection

Malicious queries and union-style attacks in URLs, parameters, and bodies.

Cross-site scripting (XSS)

Script injection in user-controlled input and reflected content.

Sensitive data exposure

Patterns that suggest credentials, tokens, or private data leaving your app.

Automated abuse

Bots, scrapers, and headless clients — see Bot management.

Managed groups stay maintained

Managed groups are versioned and updated centrally. Override individual rule actions — allow, block, count, or challenge — without losing upstream maintenance.

Custom rules

Layer your own match logic on top of managed packs: block admin paths from the public internet, require an API key header, or enforce geo- and IP-specific policies using the same expression language as managed rules.

Pattern and logic-based matching

Detect threats with high-performance pattern libraries — paths, query strings, bodies, headers, cookies, response status and body — and boolean expressions over IP, method, headers, and body fields. Combine both in one policy for defense in depth.

Patterns

Paths, headers, cookies and bodies.

Logic

Boolean expressions and field matching.

Request normalization

Apply transform profiles so encoded and obfuscated attacks — double URL encoding, null bytes, case variants — are normalized before inspection, reducing evasion gaps.

IP & network reputation rule groups

Classify and act on traffic from high-risk networks using managed and custom IP reputation-style policies.

Managed bot and threat packs label traffic from suspicious hosting ranges, known scraper networks, and automation-friendly IP space
Expression rules match CIDR block lists you maintain — or CrownWall-maintained network signals bundled in managed groups
Chain reputation hits to block, challenge, or stepped-up captcha while allowing verified monitors and partners through label-based exceptions

Reputation labels stay auditable

Reputation labels flow into later rules and access logs so you can audit who was tagged and why.

Rule labels & policy chaining

When a rule matches, attach semantic labels such as suspicious-network, scraper-ua, or rate-limit-exceeded. Downstream rules branch on those labels — block repeat offenders, challenge first-time scrapers, or allow verified bots — without duplicating detection logic.

Upstream signals on allow

Approved requests can carry extra headers to your origin — flagging verified humans, API tiers, or WAF disposition.

Professional block experience

Blocked users see a clear HTML or plain-text page with a Request ID for support.

Body size limits

Cap request and response body sizes at the edge to protect inspection and origin capacity.

Policy chaining

Use labels to branch policies without repeating detection logic.

Verification for suspicious sessions

Use browser challenge or captcha verification when traffic is suspicious but not definitively malicious.

Browser challenge

For suspicious but not definitively malicious sessions, serve a lightweight browser verification. Successful completion issues a time-limited token; returning visitors pass through without friction.

Captcha verification

When automation is likely, present a proof-of-work puzzle. Verified users receive a session token with configurable immunity — balancing security and conversion on sensitive flows.