Skip to main content

Configure WAAP for a new domain

Web Application and API Protection (WAAP) is a single SaaS tool that combines all aspects of website security and traffic management, including Layer 7 DDoS protection, and web application security.

You can add a domain to WAAP protection in two ways:

  • From the WAAP Domains page: Navigate to WAAP > Domains and click Create Domain. WAAP is pre-enabled on the CDN resource creation form. This is the quickest path to get a domain protected.
  • From CDN settings: Create a CDN resource first and enable WAAP in the resource settings. Use this approach if you already have an existing CDN resource or need more control over CDN configuration before enabling WAAP.

After the domain is added, the remaining steps — verifying traffic in Monitoring mode, allowing admin IPs, and enabling Protection mode — apply to both paths.

Tip

After you enable WAAP, all traffic will be diverted to our network, and it may cause a temporary disruption for your users. We recommend setting up CDB WAAP during a low-traffic period to minimize the impact.

Step 1. Add a domain for WAAP protection

To protect your web application and APIs with CDB WAAP, add a domain by selecting one of the following options.

Info

When configuring a resource, you need to update your domain's DNS records so they point to our network. This is necessary to allow all traffic to pass through WAAP.

  1. In the CDB Technical Web Portal, navigate to WAAP > Domains.
  2. Click Create Domain.

WAAP Domains page with the Create Domain button

  1. In the Add domain field, enter your domain name. For example, waap.example.com.
  2. Select a DNS delegation option:
    • Delegate your DNS zone to us: Routes DNS through CDB for lower latency and stronger security. No additional DNS changes needed after the CNAME step.
    • Do not delegate: Use CDN without changing your DNS provider. You can delegate later in resource settings.
  3. In the Origin section, configure your content origin:
    • Select Specify content origin to enter your origin server details.
    • In the Origin source field, enter your origin server IP address or domain name.
    • Keep Use default port selected to use port 80, or deselect it to specify a custom port.

Create resource form reached from WAAP Domains, with WAAP pre-enabled and locked

  1. Click Create and enable protection to create the CDN resource with WAAP already enabled.
  2. After the resource is created, copy the generated CNAME and add it to your DNS configuration at your DNS provider.

WAAP is enabled automatically — skip to Step 3 to verify traffic behavior.

If Orange's CDN isn't configured yet, create a CDN resource first. If you also need to add an SSL certificate, check out the Add an SSL certificate to deliver content over HTTPS guide.

Select the Delegate to CDB DNS option when creating the resource. Follow the CDN resource guide.

  1. Go to the CDN page and click Create CDN resource.
  2. In the Add domain field, enter your domain name. For example, waap.mydomain.com.
  3. Select the Do not delegate option to use CDN without changing your DNS provider.
  4. Enable the Enable WAAP toggle to activate Web Application and API Protection for your domain.
  5. In the Origin section, configure your content origin:
    • Select Specify content origin to enter your origin server details.
    • Keep the Use default Origin group name toggle enabled, or disable it to specify a custom name.
    • From the Type of origin authentication dropdown, select the authentication method if required, or keep it set to None.
    • In the Origin source field, enter your origin server IP address or domain name.
    • Keep the Use default port checkbox selected to use port 80, or deselect it to specify a custom port.

Create CDN resource form

  1. Click Create and enable protection to create the CDN resource.
  2. After the resource is created, copy the generated CNAME and add it to your DNS configuration at your DNS provider.

Finalize the settings

Once your CDN resource is created, configure the Host header setting:

  1. Open your CDN resource settings and navigate to the HTTP headers section.
  2. Click Host header and enable the Change Host header toggle.
  3. Select the Forward Host header option to forward the original Host header from client requests to your origin server.

Host header configuration

Info

The Always online option is automatically disabled when WAAP is enabled and cannot be changed.

Always online disabled

After creating the CDN resource, continue to Step 2 to enable WAAP.

Step 2. Enable WAAP in CDN resource settings

If you added the domain using the WAAP Domains page or enabled the WAAP toggle during CDN resource creation, skip to Step 3. If you created a CDN resource without enabling WAAP, enable WAAP protection now. Refer to the Protect CDN resources with CDB WAAP guide for detailed instructions.

Step 3. Use WAAP in Monitoring mode

After you enable WAAP, it will be automatically set to the Monitoring mode. In this mode, all incoming requests are inspected, but no action is taken. It's best to use Monitoring mode for several days before enabling the Protection mode to make sure that all security settings work correctly.

Completing this step is important because it allows you to analyze requests and test the WAAP behavior before you fully activate it.

Warning

In Monitoring mode, all traffic is allowed to your domain, regardless of configured security rules and policy groups. This mode is only recommended for testing WAAP settings.

Step 4. View your domain traffic

While keeping WAAP in Monitoring mode, you can view all logged requests and check the corresponding actions that WAAP will take once you put it in Protection mode.

Use the Events page to detect common traffic patterns and understand if the current configuration requires any adjustments.

  1. In the CDB Technical Web Portal, navigate to WAAP > Events.
  2. Use the Domain filter to select your domain.
  3. Review the requests and the actions WAAP has taken.

Events page in the Customer Portal

You can also use additional filters to get more granular information about your traffic. For more details about the available filters check the section Why filtering matters.

To view more information about an event, click on its row.

Step 5. Test your WAAP configuration

To achieve the desired WAAP behavior, we recommend that you navigate through your website as both a user and administrator.

Navigating the website will generate entries in the Requests table. You can use this information to determine if you need to create Firewall rules or custom WAAP rules for some requests and let them access your website's content.

Specifically, review requests that relate to:

  • Your origin IP: IP address assigned to your device.
  • Your office IP: IP address assigned to your device within your office's network.
  • Your workstation IP: IP address assigned to a workstation or specific computer in a network.

If you notice that WAAP will block such requests in Protection mode, you need to update your settings to prevent such a situation. You can find detailed instructions on how to update your settings in the following step.

Check out the allow and block IP addresses guide for more information.

Step 6. Allow admins, bots, and CMS

Before WAAP is in Protection mode, you need to ensure that critical IP addresses, content management systems (CMS), and known bots are allowed to make successful requests.

Check the WAAP policy groups for a full list of security policies and their detailed overview.

Allow admin IP addresses

If your domain doesn't use a CMS, we highly recommend allowlisting the site administrator's IP address:

  1. In the CDB Technical Web Portal, navigate to WAAP > Firewall.

Firewall page in the Customer Portal

  1. Select the needed domain from the domain dropdown.
  2. In the Allowed IPs tab, click Add IP/IP range.
  3. Enter any admin user's public IP address.
  4. Click Save.

Repeat these steps if needed.

Allow CMS

If you use content management systems, such as WordPress, allow traffic for CMS admins:

  1. In the CDB Technical Web Portal, navigate to WAAP > Default Rules.
  2. Select the needed domain from the domain dropdown.
  3. Click the CMS Protection tab.
  4. Find the desired content management system and change its mode to Allow by clicking on the mode dropdown next to it.

Default Rules page with CMS Protection tab

Tip

The WordPress WAF ruleset policy is enabled by default.

Allow Known Bots

Follow these steps to allow crawlers, scanners, monitoring bots, and similar tools to access your website:

  1. In the CDB Technical Web Portal, navigate to WAAP > Bot Management.
  2. Select the needed domain from the domain dropdown.
  3. Click the Known Bots tab and enable the desired bot by changing its mode to Allow.

Bot Management page with Known Bots tab

The Known Bots list allows several trusted bots by default, which is why we recommend reviewing this list before enabling Protection mode.

Step 7. Configure your APIs

If you plan to serve JSON requests through an API on your domain, you can disable the JavaScript injection and CAPTCHA functionalities for specified API endpoints.

You can manually add endpoints to API base path or configure the API Discovery feature to automatically detect and protect your APIs.

Step 8. Enable Protection mode

  1. In the CDB Technical Web Portal, navigate to WAAP > Domains.
  2. Find the needed domain in the list.
  3. In the WAAP domain mode column, click the mode dropdown and select Protection. WAAP will begin to inspect and act upon incoming requests.

WAAP modes dropdown on Domains page

Step 9. Block non-CDB traffic

After successful DNS propagation and verifying that domain-based traffic is being handled by WAAP, ensure that all requests to your domain are routed through CDB servers. This is necessary to prevent unauthorized traffic from bypassing WAAP and directly reaching your domain.

A WAAP domain is created automatically when WAAP is enabled on a CDN resource via the CDN API. Once created, the Domains endpoints cover listing domains and switching between Monitoring and Protection modes.

An API token is required. The domain ID is returned by the list request below.

export GCORE_API_KEY="{YOUR_API_KEY}"
export WAAP_DOMAIN_ID="{YOUR_DOMAIN_ID}"

View WAAP domains

Retrieve all WAAP-protected domains in the account along with their current protection status.

import gcore

client = gcore.CDB()

domains = client.waap.domains.list()
for domain in domains.results:
    print(f"id={domain.id}  name={domain.name}  status={domain.status}")

package main

import (
    "context"
    "fmt"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/waap"
)

func main() {
    client := gcore.NewClient()

    domains, err := client.Waap.Domains.List(context.Background(), waap.DomainListParams{})
    if err != nil {
        panic(err)
    }
    for _, d := range domains.Results {
        fmt.Printf("id=%d  name=%s  status=%s\n", d.ID, d.Name, d.Status)
    }
}

curl -X GET "https://api.cdb-staging.cdn.orange.com/waap/v1/domains" \
  -H "Authorization: APIKey ${GCORE_API_KEY}"

The response lists all domains with their IDs and current status. Use the id value as WAAP_DOMAIN_ID in subsequent requests.

Domain protection mode

Switch a domain between Monitoring mode (monitor) and Protection mode (active). In Monitoring mode, traffic is inspected but no actions are taken. In Protection mode, all configured security rules are enforced.

In Monitoring mode, all traffic is allowed regardless of configured security rules. Enable Protection mode only after verifying that legitimate traffic is not blocked.

import gcore
import os

client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])

# Enable Protection mode
client.waap.domains.update(domain_id, status="active")
print("Protection mode enabled")

# Revert to Monitoring mode
# client.waap.domains.update(domain_id, status="monitor")

package main

import (
    "context"
    "fmt"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/waap"
)

func main() {
    client := gcore.NewClient()
    domainID, _ := strconv.ParseInt(os.Getenv("WAAP_DOMAIN_ID"), 10, 64)

    // Enable Protection mode
    err := client.Waap.Domains.Update(context.Background(), domainID, waap.DomainUpdateParams{
        Status: waap.DomainUpdateParamsStatusActive,
    })
    if err != nil {
        panic(err)
    }
    fmt.Println("Protection mode enabled")

    // Revert to Monitoring mode:
    // client.Waap.Domains.Update(ctx, domainID, waap.DomainUpdateParams{
    //     Status: waap.DomainUpdateParamsStatusMonitor,
    // })
}

# Enable Protection mode
curl -X PATCH "https://api.cdb-staging.cdn.orange.com/waap/v1/domains/${WAAP_DOMAIN_ID}" \
  -H "Authorization: APIKey ${GCORE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"status": "active"}'

# Revert to Monitoring mode
# curl -X PATCH "https://api.cdb-staging.cdn.orange.com/waap/v1/domains/${WAAP_DOMAIN_ID}" \
#   -H "Authorization: APIKey ${GCORE_API_KEY}" \
#   -H "Content-Type: application/json" \
#   -d '{"status": "monitor"}'

The API returns an empty body on success. Confirm the change with the View WAAP domains request.

Additional setup

Once the domain is created and protection mode is active, the remaining setup tasks each have dedicated articles: