Configure Scan Protection
最終更新日：2026-08-27 17:20:30
Reading time: About 6 minutes
Prerequisites: The hostname has been onboarded, and the WAF policy is enabled.
Scan Protection targets pre-attack reconnaissance behavior and consists of three independent sub-features that you can enable separately as needed. Attackers typically use scanning tools to probe for vulnerable paths before launching an attack, or repeatedly trigger rules to test the boundaries. Scan Protection identifies and stops such behavior early, raising the bar and the cost for attackers.
Navigation path: Security Settings > Policies > [Target Hostname] > WAF > Scan Protection
Sub-Feature Comparison
| Sub-Feature | Detection Principle | Typical Protection Scenario |
|---|---|---|
| Scanning Tool Detection | Matches requests against the characteristics of known scanning tools (User-Agent, behavioral patterns) | Directly identifies common scanning tools such as AWVS and Nessus |
| Repeated Violation Detection | Counts how many times and how many rule types a single target triggers within a period, and determines whether it is suspicious scanning | Detects scanning behavior that probes for vulnerabilities through multiple methods |
| Directory Probing Detection | Counts a single target’s access to a large number of nonexistent directories (high 404 ratio) | Detects reconnaissance behavior such as directory traversal and path enumeration |
Scanning Tool Detection
Detects the request characteristics of common scanning tools (such as AWVS, Nessus, AppScan, Rsas, and Sqlmap) and handles them according to the configured action.
Configuration Steps
- Locate Scanning Tool Detection and set the action to Log or Deny
- Click Deploy to apply the configuration
To disable: Set the action to Not Used, then click Deploy.
Repeated Violation Detection
Counts the number of rule types and the total requests a target triggers against WAF Managed Rules within a statistical period, determines whether the behavior constitutes suspicious systematic scanning, and applies the corresponding action to that target.
Configuration Steps
- Locate Repeated Violation Detection and configure the following parameters:
| Configuration Item | Description |
|---|---|
| Action | Log / Deny |
| Statistical Target | IP (counted by IP only) / IP + JA3 fingerprint (a target is identified by the same IP and the same TLS fingerprint) |
| Statistical Period | The time window (seconds) in which repeated violations are counted |
| Rule Type Threshold | When the number of distinct WAF Managed Rules types triggered by the target within the period reaches this threshold, the action is triggered |
| Request Count Threshold | When the total number of requests blocked by WAF Managed Rules for the target within the period reaches this threshold, the action is triggered |
| Action Duration | How long (seconds) the action continues to apply to the target after it is triggered |
- Click Deploy to apply the configuration
The two thresholds use an AND relationship: the system takes action on the target only when both the rule type threshold and the request count threshold are met.
To disable: Set the action to Not Used, then click Deploy.
Directory Probing Detection
Automatically identifies and handles attack sources that access a large number of invalid directories (nonexistent paths, excluding static files such as images) within a statistical period.
Important: Because Directory Probing Detection relies on statistics collected from global nodes, it is not an exact real-time rate-limiting mechanism and may involve a delay of tens of seconds. Therefore, even with this feature enabled, some requests may still reach the origin before it takes effect.
Configuration Steps
- Locate Directory Probing Detection and configure the following parameters:
| Configuration Item | Description |
|---|---|
| Action | Log / Deny |
| Statistical Target | IP / IP + JA3 fingerprint |
| Statistical Period | The time window (seconds) in which directory probing behavior is counted |
| Request Count Threshold | When the total request count of the target within the period reaches this threshold, the system proceeds to the directory ratio check |
| Invalid Directory Request Threshold | When the number of requests to nonexistent directories by the target within the period reaches this threshold, the action is triggered |
| 404 Ratio Threshold | When the proportion of 404 responses among the target’s requests within the period reaches this threshold, the action is triggered |
| Action Duration | How long (seconds) the action continues to apply to the target after it is triggered |
- Click Deploy to apply the configuration
To disable: Set the action to Not Used, then click Deploy.
Configuration Recommendations
- First-time enablement: Set all three sub-features to Log and observe for 3–7 days to understand how often they are triggered by normal business traffic
- When running internal or legitimate security tests: Add the testing tool’s IP to the Whitelist to avoid false blocking
- Thresholds for Repeated Violation Detection: We recommend leaving some headroom above the peak QPS of normal business traffic, to avoid false blocking during peak hours caused by a large number of legitimate error requests (such as 404s)