Modify Detection Length Limits
Last update：2026-08-21 14:26:10
Reading time: About 4 minutes
Prerequisites: None
Navigation path: Security Settings > Policies > [Target Hostname] > General Settings > Detection Length Limits
Feature Description
When WAF performs security inspection on request content (such as URL, request headers, and request body), it only inspects content within a certain length range by default. Content that exceeds the detection length limit is truncated and excluded from inspection.
By adjusting the detection length limits, you can balance protection coverage and performance overhead:
- Increase the limit: WAF inspects more content for broader protection, with a slight increase in performance impact
- Decrease the limit: Reduces performance impact, but content beyond the limit is no longer protected by WAF
Configurable Detection Length Items
| Detection Item | Description | Default Value |
|---|---|---|
| Request URL Length | Maximum URL length (including path and parameters) that WAF inspects | 2048 bytes |
| Single Header Field Length | Maximum length of a single request header field value that WAF inspects | 512 bytes |
| Request Body Length | Maximum length of POST request body that WAF inspects | 8192 bytes |
When to Adjust
Consider increasing the limit when:
- Your website accepts URLs with a large number of parameters (e.g., rich-text search, complex filter conditions)
- Your API accepts large JSON request bodies (e.g., content publishing, batch operation endpoints)
- WAF is producing false negatives for long requests (the attack payload falls outside the truncated range)
Consider decreasing the limit when:
- Your website has strict request size limits, and requests exceeding those limits are considered abnormal by default
- WAF inspection performance is a critical concern
Configuration Steps
- Go to Security Settings > Policies, select the target hostname to enter the editing page
- Select the General Settings tab
- Locate Detection Length Limits and modify the length values for the corresponding detection items
- Click Deploy at the bottom (allow 1–3 minutes for the changes to take effect)
Recommendation: After making adjustments, go to Analysis & Logs > Attack Logs to check for new hits or false negatives, and confirm that the changes produce the expected results.