Web Application Firewall

Installing the ModSecurity/OWASP CRS component makes the Web Application Firewall available. It does not automatically enable blocking on every Site.

Choose a Site policy

• Off — no ModSecurity inspection for the Site.
• Detect Only — inspect requests and record matches without blocking them.
• Block — inspect requests and reject traffic that crosses the configured rule threshold.

Sensitivity

Balanced · PL1 is the recommended starting point for ordinary web applications. It keeps CRS inspection active while allowing normal application writes more room before cumulative rule matches cause a block. Strict · PL2, High sensitivity · PL3 and Maximum sensitivity · PL4 inspect more aggressively and can require additional tuning.

Use Detect Only first when you want to observe an unfamiliar application before enabling blocking.

Scheduled HTTP jobs

A Control-owned HTTP scheduled job targeting its own Site uses the trusted local Site path. You should not need to disable WAF protection just to make that same-Site scheduled request run.

Review blocked requests

Open Security → Web Application Firewall, choose the Site and select Recent WAF Blocks → Refresh. Review the request method/path, detection details and transaction ID. Export CSV saves the recent Site block list without submitted form content, cookies or credentials.

Tune a confirmed false positive

When Control can identify the CRS rule behind a blocked request, choose Tune to add a draft scoped policy for that exact method/path. Review the proposed rule IDs, keep the exception as narrow as possible, then choose Apply + Verify. You can also add a scoped policy manually when you already know the affected endpoint and rule.

Prefer scoped policies over global exclusions. Do not exclude a rule just because the request ended at a generic blocking rule; first confirm the underlying detection.

After a Control update

When a Control update changes the generated WAF policy, enabled Sites are refreshed automatically through normal Site repair/convergence. You should not need to turn WAF off and back on to receive the updated policy.