---
title: "WAF rules"
description: "Configure the Optimi web application firewall: managed rules, custom rules, rate limiting, and monitoring mode."
canonical_url: https://optimi.com/en/docs/waf-rules
md_url: https://optimi.com/en/docs/waf-rules.md
last_updated: 2026-09-04
---

# WAF rules

The web application firewall inspects every request at the edge and blocks
attacks before they reach your origin. This page covers the rule types and the
safe way to roll them out.

## Managed rules

Managed rules cover the common attack classes — SQL injection, cross-site
scripting, path traversal, protocol violations — and are maintained by Optimi
as threats evolve. They are the baseline for every property.

## Custom rules

Custom rules match on any request attribute: path, method, headers, country,
ASN, or bot score. Use them to protect application-specific endpoints, enforce
allowlists on admin areas, or block abuse patterns unique to your traffic.

## Rate limiting

Rate limiting rules count requests per client — by IP, session, or API token —
and throttle or block clients that exceed a threshold. They absorb credential
stuffing, scraping, and inventory hoarding without affecting legitimate users.

## Start in monitoring mode

Every new rule can run in **monitoring mode**: matching requests are logged but
never blocked. Watch the matches for a few days, tune out false positives, then
switch to blocking. This is the safe path to a strict policy.

## Reviewing blocked traffic

The my Optimi dashboard shows every blocked and monitored request with its
matched rule. Review it weekly — a sudden spike in a single rule usually means
an attack campaign or a false positive worth investigating.