Using ULTRA Cloud‘s application firewall (WAF)
The Application Firewall adds an extra layer of protection to your website by checking incoming requests for patterns commonly associated with attacks. You choose which rules should block matching requests, so you stay in control of what gets filtered.
Think of it as another layer of defence alongside keeping your applications updated and using secure passwords, not a guarantee that every attack will be stopped.
Enabling the firewall
- Open your website’s security settings in ULTRA Cloud.
- Enable Application Firewall.
- Select Manage settings.
- Enable the rules you want to use, or select Enable all.
- Select Save changes.
The main Application Firewall switch controls the whole feature. Each rule has its own Enabled switch that decides whether it blocks matching requests.
New rules start with blocking switched off, so turning on the firewall alone doesn’t enable every protection automatically. The card shows how many rules are currently enabled.
Enable all and Disable all affect every rule, even ones hidden by a search. Changes you make inside the settings window only take effect once you select Save changes, closing or cancelling discards them.
What to expect
When the firewall blocks a request, the visitor sees a friendly access-denied page instead of your website content. Requests from trusted IP addresses bypass the firewall entirely.
Some legitimate requests can resemble attack patterns, so it’s worth testing your website after enabling a rule to make sure everything still works as expected. Take particular care with rules that check remote URLs or file paths, as these are more likely to affect normal activity on some websites.
Enable all switches on every available rule at once, which may not suit every website. It’s often safer to enable rules individually and test as you go.
Available rules
The table below lists each rule by name, so you can find it in ULTRA Cloud, along with a plain-language description of what it looks for.
| Rule name | Description |
| Magento GraphQL styles parameter | Detects suspicious use of a styles parameter on GraphQL routes, helping filter requests associated with Magento exploit attempts. |
| Magento PayPal response PHP opener | Detects PHP code markers in requests to Magento’s PayPal response route, helping block attempts to inject code. |
| SQL UNION SELECT function | Detects a database-query pattern that may be used to retrieve information an attacker should not access. |
| SQL UNION ALL SELECT | Detects another database-query pattern commonly used in attempts to extract information. |
| SQL CONCAT function | Detects a database function that can be used to assemble information during an injection attack. |
| Remote URL parameter | Detects external web addresses passed as request values, which may be used to make vulnerable applications load remote content. Legitimate links can also match. |
| Relative file path parameter | Detects request values that point up through folders, potentially attempting to access files outside the intended location. |
| Absolute file path parameter | Detects request values that directly reference server file paths, potentially attempting to read local files. |
| Script tags in parameters | Detects JavaScript tags in request values, helping filter attempts to inject scripts into website pages. |
| PHP GLOBALS parameter | Detects attempts to supply PHP global-variable parameters, which may manipulate vulnerable application behaviour. |
| PHP REQUEST parameter | Detects attempts to manipulate PHP request-variable structures used by vulnerable applications. |
| Process environment access | Detects references to a server process information file that could expose sensitive settings. |
| Joomla configuration parameter | Detects older Joomla configuration parameters associated with attempts to alter application behaviour. |
| Base64 function expression | Detects encoding or decoding function expressions that may be used to disguise malicious instructions. |
| Encoded SQL UNION patterns | Detects SQL injection patterns using encoded spacing or separators to disguise database commands. |
| Encoded script tags | Detects script tags, including encoded forms, that may be used to inject JavaScript into pages. |
| Shell command sequences | Detects patterns that attempt to run server commands through a vulnerable application. |
| PHP stream wrappers | Detects special PHP resource references that may be abused to read files or execute code. |
| Directory traversal sequences | Detects attempts to move outside the intended folder through the requested address or its parameters. |
| Sensitive configuration paths | Detects requests for sensitive files, such as environment settings, source-control information and password files. |
| TRACE and TRACK methods | Detects diagnostic request types that ordinary website browsing generally does not need and that may expose request information. |
Troubleshooting
If a normal action on your website is blocked after enabling a rule, disable that rule, save your changes and try again. If you need help, contact support with the affected page, the approximate time and what you were trying to do.