Add Exceptions to WAF Rules

Reading time: About 5 minutes

Prerequisites: The hostname has been onboarded, and the WAF policy is enabled. We recommend first using Attack Logs to confirm the incorrectly blocked requests and the triggered rule ID.

Exception vs. Whitelist: How to Choose

Principle: prefer exceptions over whitelists. Use the whitelist only for sources you fully trust (e.g., known internal IP ranges).

Navigation path: Security Settings > Policies > [Target Hostname] > WAF > WAF Rule Exceptions

When to Add an Exception

You typically need to add an exception in the following cases:

• Business code contains SQL keywords (e.g., a search API that accepts SELECT-style query parameters)
• A rich-text editor submits content containing HTML/JS, triggering the XSS rule
• Security scanning tools (e.g., internal penetration testing tools) trigger the scan protection rule
• A partner API’s request format triggers a specific rule

Steps to Add an Exception

Adding an Exception to a Single Rule

1. Go to Analysis & Logs > Attack Logs, locate the incorrectly blocked request, and record the hostname and triggered rule ID
2. Go to Security Policy > WAF for the recorded hostname, and find the triggered rule
3. Click the dropdown icon to the left of the rule ID to open the rule configuration panel, click Create, and select the exception type to add. Supported exception types include IP, path, URI, URL parameter, User-Agent, request header, Cookie, and request body.
4. Fill in the configuration
5. Click Deploy

You can add multiple exception types under the same rule. Each exception type has an OR relationship — the rule is skipped if any one type matches.

Adding Exceptions to Multiple Rules

If you need to add exceptions to multiple rules at once, go to Shared Configurations > WAF Rule Exceptions to add them centrally:

1. Go to Analysis & Logs > Attack Logs, locate the incorrectly blocked request, and record the triggered rule ID
2. Go to Shared Configurations > WAF Rule Exceptions, and click Create Exception
3. Fill in the configuration:

4. Click Confirm — the system automatically loads the WAF Rule Exceptions list page
5. In the list, find the newly added exception, and click the Associate Hostname icon in the Operations column to associate hostnames with it
6. If you need to associate the same hostnames with multiple exceptions at once, use the Batch Associate Hostnames button above the list

Match Condition Precision Recommendations

Exception match conditions should be as precise as possible to minimize gaps in security coverage:

Configuration Example

Scenario: The rich-text editor’s save endpoint /api/article/save triggers the WAF XSS rule (rule ID: 5000), but this is legitimate business behavior.

Exception configuration:

• Rules to Exclude: 5000
• Match Conditions:
  • Request path = /api/article/save
  • Client IP = 203.0.113.50

After configuration, only requests from 203.0.113.50 accessing /api/article/save skip the XSS rule 5000. XSS detection for other sources and paths remains unaffected.