How should Challenge TTL setting be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should Challenge TTL setting be configured in Aegisify WAF, and what is the current default? is part of the WAF request-inspection, enforcement, visibility, or exception-management surface. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.challenge.ttl_seconds 1800 The shipped value of 1800 is the current timing baseline used to balance responsiveness, user impact, and processing overhead. For the same event limit, a longer accumulation window or lockout/cooldown usually increases protection and user disruption; a shorter interval resets sooner. Tune together with the corresponding event threshold. ddos.emergency_minimums.challenge 3 The shipped value of 3 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.admin_ajax.challenge 120 The shipped value of 120 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.cache_bypass.challenge 40 The shipped value of 40 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.global.challenge 300 The shipped value of 300 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.rest.challenge 160 The shipped value of 160 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.search.challenge 35 The shipped value of 35 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.wp_admin.challenge 80 The shipped value of 80 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, challenge, ttl, managed_rules, ttl_seconds, ddos, emergency_minimums, groups, admin_ajax, cache_bypass, global, rest Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Managed Rules: File Upload abuse enforcement (PRO) work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Managed Rules: File Upload abuse enforcement (PRO) work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.categories.file_upload ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.thresholds.file_upload 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.allowed_methods Allowed values: ["ANY","GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.free_max_rows Maximum: 5 5 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.global_or_root_waf_exclusions_rejected Rejected The current safety logic rejects this condition to prevent an overly broad security bypass. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. custom_rules.import_max_bytes Maximum: 524288 524288 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, abuse, custom, enforcement, file, managed, rule, rules, signature, upload, managed_rules, categories, file_upload, thresholds, custom_rules Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Managed Rules: SSRF category enforcement (PRO) work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Managed Rules: SSRF category enforcement (PRO) work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.categories.ssrf ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.thresholds.ssrf 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.allowed_methods Allowed values: ["ANY","GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.free_max_rows Maximum: 5 5 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.global_or_root_waf_exclusions_rejected Rejected The current safety logic rejects this condition to prevent an overly broad security bypass. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. custom_rules.import_max_bytes Maximum: 524288 524288 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, category, custom, enforcement, managed, rule, rules, signature, ssrf, managed_rules, categories, thresholds, custom_rules, action_default, allowed_actions Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Managed Rules: Command Injection category enforcement (PRO) work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Managed Rules: Command Injection category enforcement (PRO) work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.categories.cmd_injection ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.categories.nosql_injection ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.thresholds.cmd_injection 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.thresholds.nosql_injection 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.allowed_methods Allowed values: ["ANY","GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.free_max_rows Maximum: 5 5 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, category, command, custom, enforcement, injection, managed, rule, rules, signature, managed_rules, categories, cmd_injection, nosql_injection, thresholds Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Managed Rules: RCE category enforcement (PRO) work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Managed Rules: RCE category enforcement (PRO) work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.categories.rce ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.thresholds.rce 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.allowed_methods Allowed values: ["ANY","GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.free_max_rows Maximum: 5 5 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.global_or_root_waf_exclusions_rejected Rejected The current safety logic rejects this condition to prevent an overly broad security bypass. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. custom_rules.import_max_bytes Maximum: 524288 524288 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, category, custom, enforcement, managed, rce, rule, rules, signature, managed_rules, categories, thresholds, custom_rules, action_default, allowed_actions Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Managed Rules: Path Traversal category toggle work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Managed Rules: Path Traversal category toggle work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.categories.path_traversal ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.thresholds.path_traversal 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.allowed_methods Allowed values: ["ANY","GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.free_max_rows Maximum: 5 5 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.global_or_root_waf_exclusions_rejected Rejected The current safety logic rejects this condition to prevent an overly broad security bypass. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. custom_rules.import_max_bytes Maximum: 524288 524288 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, category, custom, managed, path, rule, rules, signature, toggle, traversal, managed_rules, categories, path_traversal, thresholds, custom_rules Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Managed Rules: XSS category toggle work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Managed Rules: XSS category toggle work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.categories.xss ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.thresholds.xss 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.allowed_methods Allowed values: ["ANY","GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.free_max_rows Maximum: 5 5 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.global_or_root_waf_exclusions_rejected Rejected The current safety logic rejects this condition to prevent an overly broad security bypass. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. custom_rules.import_max_bytes Maximum: 524288 524288 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, category, custom, managed, rule, rules, signature, toggle, xss, managed_rules, categories, thresholds, custom_rules, action_default, allowed_actions Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Managed Rules: SQLi category toggle work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Managed Rules: SQLi category toggle work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.categories.sqli ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.thresholds.sqli 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.allowed_methods Allowed values: ["ANY","GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.free_max_rows Maximum: 5 5 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.global_or_root_waf_exclusions_rejected Rejected The current safety logic rejects this condition to prevent an overly broad security bypass. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. custom_rules.import_max_bytes Maximum: 524288 524288 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, category, custom, managed, rule, rules, signature, sqli, toggle, managed_rules, categories, thresholds, custom_rules, action_default, allowed_actions Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does DDoS progressive enforcement work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does DDoS progressive enforcement work in Aegisify WAF, and what should administrators verify? controls progressive request-volume defense, endpoint-specific thresholds, challenge/rate-limit/block transitions, cooldowns, and emergency sensitivity. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → DDoS Protection. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely ddos.emergency_minimums.challenge 3 The shipped value of 3 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.emergency_minimums.rate_limit 5 The shipped value of 5 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.admin_ajax.challenge 120 The shipped value of 120 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.admin_ajax.rate_limit 180 The shipped value of 180 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.cache_bypass.challenge 40 The shipped value of 40 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.cache_bypass.rate_limit 60 The shipped value of 60 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.global.challenge 300 The shipped value of 300 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.global.rate_limit 420 The shipped value of 420 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, abuse, challenge, ddos, enforcement, progressive, rate, volume, emergency_minimums, rate_limit, groups, admin_ajax, cache_bypass Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How should DDoS rate window + thresholds be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should DDoS rate window + thresholds be configured in Aegisify WAF, and what is the current default? controls progressive request-volume defense, endpoint-specific thresholds, challenge/rate-limit/block transitions, cooldowns, and emergency sensitivity. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → DDoS Protection. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely ddos.emergency_minimums.rate_limit 5 The shipped value of 5 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.admin_ajax.rate_limit 180 The shipped value of 180 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.cache_bypass.rate_limit 60 The shipped value of 60 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.global.rate_limit 420 The shipped value of 420 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.rest.rate_limit 220 The shipped value of 220 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.search.rate_limit 55 The shipped value of 55 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.wp_admin.rate_limit 120 The shipped value of 120 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.wp_cron.rate_limit 40 The shipped value of 40 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, abuse, challenge, ddos, limit, rate, threshold, thresholds, volume, window, emergency_minimums, rate_limit, groups, admin_ajax, cache_bypass Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

Archives: FAQs | Aegisify - WordPress Tools, Security…

Categories: AegisWAF
How should Challenge TTL setting be configured in Aegisify WAF, and what is the current default?
read more
Categories: AegisWAF
How does Managed Rules: File Upload abuse enforcement (PRO) work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How does Managed Rules: SSRF category enforcement (PRO) work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How does Managed Rules: Command Injection category enforcement (PRO) work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How does Managed Rules: RCE category enforcement (PRO) work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How does Managed Rules: Path Traversal category toggle work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How does Managed Rules: XSS category toggle work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How does Managed Rules: SQLi category toggle work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How does DDoS progressive enforcement work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How should DDoS rate window + thresholds be configured in Aegisify WAF, and what is the current default?
read more

What’s New At Aegisify