# Rules and protections

> What the PingLess WAF managed ruleset stops — HTTP floods, bots, common CVEs — and the rate shaping, schema protection, and custom rules WAF Pro adds.
>
> Canonical: https://xdp.network/docs/pingless-waf/rules · Updated 2026-08-09

PingLess WAF ships with a managed ruleset that is on from the moment DNS points
at the edge — no configuration needed. This page covers what the ruleset stops
and what WAF Pro adds on top.

## What the managed ruleset covers

### HTTP flood absorption

Layer-7 request floods are dropped at the edge, upstream of your origin. The
flood is absorbed on our network, so your server keeps answering real visitors
instead of drowning in junk requests. See
[Attack types](/docs/attack-mitigation/attack-types) for what these floods look
like.

### Bot filtering

The edge scores clients and serves a JavaScript challenge only to suspicious
ones. Real browsers pass automatically; simple bots and scripts fail the
challenge and never reach your origin.

:::note
Humans never see a captcha wall. Challenges are invisible JavaScript checks
aimed at clients that already look like bots.
:::

### Virtual patching

Managed rules block known exploit patterns for common CVEs at the edge. When a
new vulnerability starts being exploited, the rule update protects your site
while you patch the application on your own schedule.

## What WAF Pro adds

### Per-route rate shaping

Fine-grained throttles per route — a tight limit on a login endpoint, a loose
one on static pages — so one hot endpoint cannot take down the rest of your
API.

### API schema protection

Requests are validated against your API schema at the edge. Malformed payloads
are rejected early, before your application spends any effort parsing them.

### Custom rulesets

Deploy your own signatures alongside the managed rules. Rules you write go live
at the edge in minutes.

## Protection by plan

| Protection | WAF | WAF Pro |
| --- | --- | --- |
| HTTP flood absorption | Included | Included |
| Bot filtering (JS challenges) | Included | Included |
| Virtual patching (managed CVE rules) | Included | Included |
| Per-route rate shaping | — | Included |
| API schema protection | — | Included |
| Custom rulesets | — | Included |

## Next steps

- [WAF vs WAF Pro](/docs/pingless-waf/waf-vs-waf-pro)
- [Setup](/docs/pingless-waf/setup)
- [Attack types](/docs/attack-mitigation/attack-types)