Capabilities

Everything an edge WAF needs, nothing switched on for you

PingWAF ships protections disabled per site. Enable what your traffic needs, in the order you need it, and every change is versioned.

Detection

A semantic engine, not a regex list

Requests are normalized first, then scored by signatures, heuristics and expressions before a verdict is produced.

Normalization runs before any rule, so encoding tricks cannot hide a payload.
libinjection heuristics for SQLi and XSS plus Aho-Corasick multi-pattern matching for the rest.
Cloudflare-style expressions such as http.request.uri.path contains "/admin" and ip.src in {10.0.0.0/8}.
Anomaly scoring aggregates every match into one verdict per request.

normalize → signatures → expression → anomaly score

Availability

Layered challenges stop request floods without a CAPTCHA wall in front of your users.

JavaScript 5-second shield, proof of work and interactive challenges.
Clearance cookies are HMAC-signed, so a pass cannot be forged or replayed elsewhere.
Verified-bot allow lists and known-browser pass-through keep crawlers and monitoring working.
Challenges apply per site, so a strict policy on one hostname does not affect another.

TLS fingerprinting and behavioural analysis are on the roadmap.

Access

Block, allow or challenge by address and region, and cap abuse per request dimension.

IP access rules with block, allow, challenge and js_challenge actions, CIDR ranges, CSV bulk import and named rules.
Global IP groups built from plain-text, JSON or Cloudflare IP-range subscriptions, synced on a schedule with error reporting.
Geo restrictions by country and ASN, including an optional block-unknown-countries policy.
Rate limiting by IP, host, path, ASN, country, header, cookie or query parameter.

Traffic

Origin pools, routes and the cache live next to the security policy, so a rule and a route change together.

Origin pools with round-robin, least connections, random, and consistent hashing by IP, URL, path, header, cookie or query.
Routes by prefix, exact match or regex — optionally limited to an IP group so a path can serve office and partner networks differently.
Edge cache with per-site disk quotas, LRU eviction, stale-while-revalidate and browser TTL control.
Header, path, query and body rewriting, Tera error pages, and a per-site pause that serves 503 while the certificate keeps working.

TLS

ACME runs on the data plane, and the control plane always knows what each agent currently holds.

Automatic ACME / Let's Encrypt issuance and renewal with HTTP-01 and DNS-01 challenges.
DNS-01 through Aliyun, Cloudflare, Tencent Cloud DNSPod, Huawei Cloud or manual DNS.
Per-site certificate status (valid, expiring soon, expired) reported over heartbeats, plus a searchable ACME event log.
HSTS and forced HTTPS at the edge, mutual TLS with console-issued client certificates and immediate revocation.

Origin certificate verification is an explicit switch, deployment-wide or per pool.

Observability

Logs are stored where your existing tooling can query them, and a blocked request can be replayed as a curl command.

Full request logging to Elasticsearch with body truncation and a WAL buffer for reliability.
Raw request and response capture in PostgreSQL — headers verbatim, body prefixes, real sizes and truncation flags.
Traffic and attack analytics dashboards built from the metrics agents ship on every heartbeat.
Agent health, cache hit rates and eviction counters visible from the control plane.

Operations

Configuration is versioned, agents are observable, and the console itself is compiled into the binary.

JWT + bcrypt authentication, multi-tenant isolation and passkey (WebAuthn) sign-in.
Configuration versioning: list snapshots with filters, diff a version against its predecessor table by table, roll back behind a confirmation.
Embedded English, 简体中文 and 日本語 console built with rust-embed — no separate frontend deployment.
Agent fleet view with live status, plus in-process CPU and memory attribution from the system endpoints.

Scoring

Each request leaves the pipeline with exactly one verdict, and that verdict is what the log records.

Verdict	What it means	What the edge does
Pass	No rule crossed the threshold.	Forwarded to the origin untouched.
Monitor	Suspicious, but below the blocking threshold.	Forwarded and recorded so you can tune the rule before enforcing it.
Block	The score crossed the blocking threshold.	Rejected with a WAF block page and logged with the matched rules.
Challenge	The request must prove it is a browser.	Served a JS or proof-of-work challenge; on success the client continues with a clearance cookie.

The architecture and WAF engine documents walk through the request lifecycle, rule evaluation and scoring.