Recommended Initial Setup

Reading time: About 10 minutes
Target audience: Users who have just onboarded a hostname and want to quickly establish an effective protection baseline

Different business types face different threats. Choose the configuration plan that matches your business scenario.

Plan 1: General Web Application

Suitable for corporate websites, content/information sites, and brand portals.

Configuration checklist (in order of priority):

• WAF Managed Rules → Enable, Mode: Monitor (switch to Block after 7 days)
• Threat Intelligence → Enable all types
• IP/Geo Firewall → Enable, do not add rules yet; add them based on log analysis
• Bot Management → Skip for now; configure after understanding traffic composition
• Rate Limiting → Skip for now

After the observation period ends, see WAF Managed Rules Configuration Guide for instructions on safely switching to Block mode.

Plan 2: E-commerce / High-Interaction Services

Suitable for e-commerce platforms, ticketing sites, and promotional campaign pages. These sites are highly susceptible to bot attacks and traffic abuse.

Configuration checklist:

• WAF Managed Rules → Enable, Mode: Monitor (switch to Block after 3 days)
• Threat Intelligence → Enable
• Bot Management → Enable, Web Bot Detection mode: Log (analyze bot traffic patterns first)
• Rate Limiting → Enable, create rate limit rules for login, registration, and payment endpoints

High-priority actions:

1. Create rate limiting rules for login endpoints (/login, /api/auth): max 20 requests per IP per minute
2. Refer to the E-commerce protection scenario in the Bot Management Configuration Guide

Plan 3: API Services / Developer Platform

Suitable for SaaS platforms, open platforms, and mini-program backend APIs that provide external APIs.

Configuration checklist:

• WAF Managed Rules → Enable, Mode: Block (API requests follow a fixed format, resulting in a low false positive rate)
• API Security → Enable, complete API inventory definition
• Rate Limiting → Enable, configure rate limit rules per API endpoint path
• Threat Intelligence → Enable
• Web Bot Detection in Bot Management → Not recommended for API endpoints (the JS SDK is ineffective for API calls)

Important: For pure API hostnames, configure traffic exceptions that bypass Web Bot Detection in Bot Management to avoid blocking legitimate API requests.

Plan 4: Media / Video / Download Services

Suitable for video platforms, file download sites, and image CDNs. Traffic abuse is the primary risk for these services.

Configuration checklist:

• Threat Intelligence → Enable
• IP/Geo Firewall → Configure as needed to block access from high-risk regions with no business presence
• Rate Limiting → Set reasonable rate limits for resource download endpoints
• WAF Managed Rules → Optional; resource-type endpoints typically trigger fewer rule matches

Verification Steps After Configuration

1. Go to Analysis & Logs > Web Security Trends and confirm that data is being displayed
2. Check the ratio of Attack Requests and Monitored Requests
3. Click Top Rules Triggered and review for false positives
4. After the observation period ends, refer to Validate Policies with Monitor/Log Mode to complete the switch