Self-service WAF guide

KeeProtect WAF Docs

Customer-facing setup, CDN cache, Azure Front Door operations and incident export guidance for sites hosted anywhere.

Open Portal Customer Setup
Traffic path

How protection is delivered

Visitor traffic reaches Azure Front Door and KeeProtect WAF before the customer origin. KeeProtect manages managed TLS, CDN cache behavior, route classes and Layer 7 shield controls.

Visitor -> Azure Front Door / KeeProtect WAF -> KeeProtect shield -> Customer origin
Onboarding

Customer setup checklist

  1. Add the protected domain.
  2. Add origin host, port, host header and health path.
  3. Classify real routes as public, static, login, admin, API, upload, checkout or private.
  4. Apply a managed WAF preset.
  5. Queue provisioning, add TXT validation and cut DNS to the shown Front Door target.
  6. Queue runtime validation and CDN/WAF sync after changes.
Cache safety

Routes that can be cached

Cache only public/static routes that do not depend on login cookies. Login, admin, API, upload, checkout and private categories are intentionally excluded from generated edge-cache rules.

RouteCategoryPolicy
/assets/*staticassets_10m
/css/*staticassets_10m
/js/*staticassets_10m
/Docspublicpublic_html_30s
Operations

Self-service actions

ActionUse
Queue ProvisionCreate or update custom domain, origin, route, rule set and WAF binding.
Queue CDN/WAF SyncRebuild generated cache rules and relink route policy.
Queue Runtime CheckConfirm Azure resources and visible DNS status.
Purge CDN CachePurge only generated cacheable route prefixes for that domain.
Reporting

Commercial dashboard and exports

The customer panel exposes health score, mitigated requests, origin errors, commercial alerts and exports for customer communication or Log Analytics-style ingestion.

  • Dashboard JSON for integration.
  • Summary CSV for reviews.
  • Event CSV for incident investigations.
  • Alert CSV for monthly or post-incident reports.
Incident handling

False positive workflow

Review top paths, top IPs, route categories and recent status codes before tightening a rule. Fix route classification first, then use targeted allow, challenge, throttle or block controls.