SQL & injection attacks
Covered by OWASP CRS 4.x out of the box — including SQLi patterns that would otherwise hit forms and APIs on origin.
Stopped by OVHcloud WAF before origin
Threats OWAF filters for this site
When OWAF is in Blocking mode, matching requests get 403 Forbidden and never reach this nginx backend. Detection mode logs the same signals without rejecting traffic.
XSS & malicious scripts
Cross-site scripting and related script injection attempts are scored and can be blocked at the OVHcloud edge.
RCE, LFI & SSTI probes
Built-in rules target remote code execution probes, local file inclusion, and server-side template injection patterns.
Credential theft & ATO
Automated login attempts, credential stuffing, and brute-force against auth endpoints — a core OWAF use case.
Bots & scanners
Tell search-engine bots from scrapers and vulnerability scanners; apply the right policy to each.
Protocol violations
Malformed or abusive HTTP that CRS flags as protocol anomalies — rejected before this static site is touched.
What you see vs what origin sees
Educational summary aligned with OWAF alpha behaviour.
| Event | OWAF action | This origin (/var/www/waf) |
|---|---|---|
| Clean page view | Proxy to backend | Serves HTML / CSS / images |
| CRS match (Blocking) | 403 Forbidden | No request received |
| CRS match (Detection) | Log only, still proxy | Receives traffic as usual |
| Virtual patch rule | Block exploit pattern for a CVE | Stays unpatched but shielded |
| Rate-limit trip | Throttle abusive client | Load stays bounded |
Tune in the console, not in the app
False positives are handled by adjusting OWAF policies — paranoia level, rule actions, or custom exceptions — in the WAF Console. This demo site stays a plain origin.