AST Semantic Analysis Engine
Modern web attack detection engine based on multi-layer recursive decoding and Abstract Syntax Tree (AST) grammar analysis, achieving 97.08% TPR on external benchmark corpora.
Security Protection Policies
Complete guide to the AST semantic engine, custom regex rules, IP/GeoIP filtering, bot challenges, sharded sliding-window counter rate limits, ACLs, and block pages.
CheeseWAF provides a defense-in-depth architecture spanning from network-level controls to application semantic analysis. Baseline protection policies are defined globally in protection and protection.policy, with support for granular per-site overrides via sites[].waf.protection_policy.
Custom Regex Rules
High-performance Go RE2 regular expression rules with priority ordering, target location matching, strict validation limits, and batch import/export.
IP, GeoIP & Client Fingerprinting
Configure IP whitelists and blacklists, GeoIP country restrictions, threat intelligence feed synchronization, and client soft-fingerprinting.
Bot Challenges & CAPTCHA Mitigation
Configure silent JavaScript challenges, Proof of Work (Altcha), slider and image CAPTCHAs, management console defense, and waiting room scheduling.
Rate Limiting & Traffic Shaping
High-performance sharded sliding-window counter rate limiting on the Data Plane with queueing and rejection handling.
Access Control Lists (ACL)
Rapid request filtering and denial based on HTTP methods, URI path prefixes, and request headers.
Block Pages & HTML Sanitization
Configure responsive block page templates, upload custom HTML designs, SanitizeBlockPageHTML anti-XSS policy, and Trace ID request tracking.