Key features

IskWaf2 min readPage 1 of 13

Key features

  • Multi-level security rules:
    • IP address/CIDR (an exact IP takes priority over a subnet).
    • Country (with exceptions for trusted bots).
    • User-Agent (types: contains, exact match, regular expression).
    • Referrer (types: contains, exact match, regular expression).
    • Request URI (types: contains, exact match, regular expression, starts with; with or without the query string).
  • Smart rule automation:
    • Allowing rules are created automatically for subnets of trusted bots (Google, Yandex and others).
    • Blocking rules are created automatically for subnets of unwanted hosting providers/proxies.
    • Rules are created from autonomous system (ASN) data by CRON.
  • Flexible rule actions: Block (403), CAPTCHA, Allow.
  • Local CAPTCHA: numeric, “first/last 3 digits” out of 6, session-based.
  • Optional WAF check modes:
    • Check on every request (standard behaviour).
    • Check once per session (reduces load for already verified users).
  • Logging: detailed trigger logs, configurable modes (`full`, `triggered`, `off`), automatic cleanup of old logs. Logs also show whether WAF rules were skipped because of the session check.
  • IP address analysis: country, region, city, ASN and ISP for logged IP addresses using the local IP2Location LITE databases (via CRON).
  • Daily reports: aggregated statistics on WAF events, rule types, search bot hits and the top N offenders (as JSON), including geolocation data.
  • Manager interface (CMP): tabs for logs (with country/city), each rule type and reports; create, edit, enable/disable and delete rules.

IskWaf is a basic protection tool and does not replace comprehensive enterprise security solutions or dedicated WAF services. Use it at your own risk. Always keep up-to-date backups of your site.