Rules and protections
What the PingLess WAF managed ruleset stops — HTTP floods, bots, common CVEs — and the rate shaping, schema protection, and custom rules WAF Pro adds.
Last updated
On this page
PingLess WAF ships with a managed ruleset that is on from the moment DNS points at the edge — no configuration needed. This page covers what the ruleset stops and what WAF Pro adds on top.
What the managed ruleset covers
HTTP flood absorption
Layer-7 request floods are dropped at the edge, upstream of your origin. The flood is absorbed on our network, so your server keeps answering real visitors instead of drowning in junk requests. See Attack types for what these floods look like.
Bot filtering
The edge scores clients and serves a JavaScript challenge only to suspicious ones. Real browsers pass automatically; simple bots and scripts fail the challenge and never reach your origin.
Virtual patching
Managed rules block known exploit patterns for common CVEs at the edge. When a new vulnerability starts being exploited, the rule update protects your site while you patch the application on your own schedule.
What WAF Pro adds
Per-route rate shaping
Fine-grained throttles per route — a tight limit on a login endpoint, a loose one on static pages — so one hot endpoint cannot take down the rest of your API.
API schema protection
Requests are validated against your API schema at the edge. Malformed payloads are rejected early, before your application spends any effort parsing them.
Custom rulesets
Deploy your own signatures alongside the managed rules. Rules you write go live at the edge in minutes.
Protection by plan
| Protection | WAF | WAF Pro |
|---|---|---|
| HTTP flood absorption | Included | Included |
| Bot filtering (JS challenges) | Included | Included |
| Virtual patching (managed CVE rules) | Included | Included |
| Per-route rate shaping | — | Included |
| API schema protection | — | Included |
| Custom rulesets | — | Included |