How should Per-path thresholds (wildcards supported; per-path limit/min override) be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should Per-path thresholds (wildcards supported; per-path limit/min override) be configured in Aegisify WAF, and what is the current default? is part of the WAF request-inspection, enforcement, visibility, or exception-management surface. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely bot.per_path_limits [] Blank or empty by default because this value depends on the site, organization, route, identity source, recipient, API credential, or exception policy. Configure it only with verified site-specific data. Supply only validated site-specific values. Leaving it blank/empty means no custom value, exception, recipient, credential, route, or policy has been asserted by default. managed_rules.thresholds.path_traversal 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. ai_security.consumption.characters_per_token 4 The shipped value of 4 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ai_security.consumption.input_cost_per_million_cents 0 Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. ai_security.consumption.output_cost_per_million_cents 0 Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. ai_security.consumption.requests_per_minute 30 The shipped value of 30 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. app_monitoring.target_rows_per_page 25 The shipped value of 25 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. bot.default_limit_per_min Minimum: 180 180 is the current code-enforced minimum boundary, not a recommended default. Values below it are clamped or rejected by the current save path. Do not tune below this boundary. Adjust the corresponding primary setting at or above this minimum and validate legitimate traffic/workload. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, limit, max, maximum, min, override, path, per, rate, supported, threshold, thresholds, wildcards, bot, per_path_limits Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Bad User-Agent blocking (token contains match; blocks) work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Bad User-Agent blocking (token contains match; blocks) work in Aegisify WAF, and what should administrators verify? governs deterministic inspection of AI-facing traffic, including prompt-injection signals, sensitive-data handling, provider/model policy, agentic action controls, signed actions, and resource budgets. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → AI Security. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely bot.bad_ua_list curl wget python-requests httpclient “curl wget python-requests httpclient ” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.block_bad_ua ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. bot.crawler_policies.agent compatible “compatible” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. common_attacks.credential_distinct_user_limit 6 The shipped value of 6 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. wp_protect.rest_block_user_enum ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. bot.crawler_policies.ads standard “standard” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.crawler_policies.other standard “standard” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.crawler_policies.search compatible “compatible” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, agent, bad, blocking, blocks, contains, match, token, user, bot, bad_ua_list, block_bad_ua, crawler_policies, common_attacks, credential_distinct_user_limit Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How should Default rate limit per minute (enforced per IP + path + minute bucket) be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should Default rate limit per minute (enforced per IP + path + minute bucket) be configured in Aegisify WAF, and what is the current default? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely ddos.emergency_minimums.rate_limit 5 The shipped value of 5 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.admin_ajax.rate_limit 180 The shipped value of 180 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.cache_bypass.rate_limit 60 The shipped value of 60 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.global.rate_limit 420 The shipped value of 420 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.rest.rate_limit 220 The shipped value of 220 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.search.rate_limit 55 The shipped value of 55 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.wp_admin.rate_limit 120 The shipped value of 120 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.wp_cron.rate_limit 40 The shipped value of 40 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, abuse, bucket, ddos, enforced, ip, limit, max, maximum, minute, path, per, rate, threshold, emergency_minimums Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

When should administrators use Enable Bot Control (front requests + REST requests enforcement) in Aegisify WAF?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary When should administrators use Enable Bot Control (front requests + REST requests enforcement) in Aegisify WAF? protects API traffic by inspecting routes, bodies, authentication requirements, identities, schemas, rate behavior, and protocol-specific abuse signals. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → API Shield. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely bot.crawler_policies.agent compatible “compatible” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.bad_ua_list curl wget python-requests httpclient “curl wget python-requests httpclient ” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.block_bad_ua ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. bot.crawler_policies.ads standard “standard” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.crawler_policies.other standard “standard” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.crawler_policies.search compatible “compatible” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.crawler_policies.training standard “standard” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, agent, api, automation, bot, control, crawler, enable, endpoint, enforcement, front, requests, rest, route, ua Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How should Visual Intelligence charts (7-day trend, category breakdown, top routes, action outcomes) be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should Visual Intelligence charts (7-day trend, category breakdown, top routes, action outcomes) be configured in Aegisify WAF, and what is the current default? is part of the WAF request-inspection, enforcement, visibility, or exception-management surface. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → API Shield. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely waf.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. waf.mode observe “observe” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. managed_rules.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.sensitivity balanced “balanced” is the shipped baseline and is the closest current code-defined baseline/medium operating point. Use stricter behavior only after reviewing site-specific evidence. Treat the shipped value as the baseline/medium operating point. A stricter profile generally increases sensitivity and may increase false positives or workload; a more permissive profile generally reduces intervention but can allow more unwanted activity. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, action, breakdown, category, charts, day, intelligence, outcomes, routes, top, trend, visual, waf, enabled, mode Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Import/Export WAF Rules JSON (move rules between sites) work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Import/Export WAF Rules JSON (move rules between sites) work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → Logs. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely custom_rules.import_max_bytes Maximum: 524288 524288 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.import_max_rules Maximum: 100 100 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.import_requires_pro PRO required The current UI/save path makes this capability license-gated rather than a site-tuning default. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.allowed_methods Allowed values: ["ANY","GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.free_max_rows Maximum: 5 5 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.global_or_root_waf_exclusions_rejected Rejected The current safety logic rejects this condition to prevent an overly broad security bypass. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, between, custom, export, import, json, managed, move, rule, rules, signature, sites, custom_rules, import_max_bytes, import_max_rules Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How should WP Default “Revert” snapshot behavior after applying presets be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should WP Default “Revert” snapshot behavior after applying presets be configured in Aegisify WAF, and what is the current default? is part of the WAF request-inspection, enforcement, visibility, or exception-management surface. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely ddos.groups.wp_admin.block 180 The shipped value of 180 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.wp_admin.challenge 80 The shipped value of 80 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.wp_admin.rate_limit 120 The shipped value of 120 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.wp_cron.block 70 The shipped value of 70 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.wp_cron.challenge 25 The shipped value of 25 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.wp_cron.rate_limit 40 The shipped value of 40 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. ddos.groups.wp_login.block 60 The shipped value of 60 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.wp_login.challenge 20 The shipped value of 20 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, after, applying, behavior, presets, revert, snapshot, wp, ddos, groups, wp_admin, block, challenge, rate_limit, wp_cron Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Rule Sets presets: WP Login Protection / XML-RPC Hard Block / WP-JSON Throttle work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Rule Sets presets: WP Login Protection / XML-RPC Hard Block / WP-JSON Throttle work in Aegisify WAF, and what should administrators verify? provides security telemetry and forensic context for inspected, challenged, rate-limited, blocked, and operational events. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → Logs. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely ddos.groups.wp_login.block 60 The shipped value of 60 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.wp_login.challenge 20 The shipped value of 20 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.wp_login.rate_limit 35 The shipped value of 35 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. access.login_branding OFF / false Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. access.login_logo_id 0 Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. logs.alert_rule.blank_recipients_use_wp_admin_email Blank → WordPress admin email This is the current recipient fallback behavior when no explicit alert email is configured. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, authentication, block, brute, credential, custom, hard, json, lockout, login, managed, password, presets, protection, rpc Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How should Endpoint Policies: override action + categories + thresholds per path (UI uses PRO Mode) be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should Endpoint Policies: override action + categories + thresholds per path (UI uses PRO Mode) be configured in Aegisify WAF, and what is the current default? is part of the WAF request-inspection, enforcement, visibility, or exception-management surface. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → API Shield. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely bot.per_path_limits [] Blank or empty by default because this value depends on the site, organization, route, identity source, recipient, API credential, or exception policy. Configure it only with verified site-specific data. Supply only validated site-specific values. Leaving it blank/empty means no custom value, exception, recipient, credential, route, or policy has been asserted by default. managed_rules.categories.path_traversal ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.thresholds.path_traversal 1 Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. api.default_action inspect “inspect” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. wp_protect.thresholds_rest.block_at 0 Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. wp_protect.thresholds_rest.challenge_at 0 Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. wp_protect.thresholds_rest.rate_limit_at 0 Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. ai_security.agency.action monitor “monitor” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Where this control exposes Off / Monitor / Block: Off disables its decision path; Monitor records/evaluates without blocking; Block enforces the decision. Start with Monitor for uncertain traffic, then move to Block after reviewing false positives and exceptions. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, action, categories, endpoint, mode, override, path, per, policies, thresholds, uses, bot, per_path_limits, managed_rules, path_traversal Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Endpoint Policies framework (per-path policy match + applied logging) work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Endpoint Policies framework (per-path policy match + applied logging) work in Aegisify WAF, and what should administrators verify? provides security telemetry and forensic context for inspected, logged, challenged, rate-limited, blocked, and operational events across WAF subsystems. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → Logs. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely bot.crawler_policies.ads standard “standard” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.crawler_policies.agent compatible “compatible” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.crawler_policies.other standard “standard” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.crawler_policies.search compatible “compatible” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. bot.crawler_policies.training standard “standard” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. ddos.endpoint_allowlist (blank / site-specific) Blank or empty by default because this value depends on the site, organization, route, identity source, recipient, API credential, or exception policy. Configure it only with verified site-specific data. Supply only validated site-specific values. Leaving it blank/empty means no custom value, exception, recipient, credential, route, or policy has been asserted by default. ai_security.output_handling.require_structured_rest OFF / false Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. ai_security.rest_enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, applied, endpoint, framework, logging, match, path, per, policies, policy, bot, crawler_policies, ads, agent, other Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

Archives: FAQs | Aegisify - WordPress Tools, Security…

Categories: AegisWAF
How should Per-path thresholds (wildcards supported; per-path limit/min override) be configured in Aegisify WAF, and what is the current default?
read more
Categories: AegisWAF
How does Bad User-Agent blocking (token contains match; blocks) work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How should Default rate limit per minute (enforced per IP + path + minute bucket) be configured in Aegisify WAF, and what is the current default?
read more
Categories: AegisWAF
When should administrators use Enable Bot Control (front requests + REST requests enforcement) in Aegisify WAF?
read more
Categories: AegisWAF
How should Visual Intelligence charts (7-day trend, category breakdown, top routes, action outcomes) be configured in Aegisify WAF, and what is the current default?
read more
Categories: AegisWAF
How does Import/Export WAF Rules JSON (move rules between sites) work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How should WP Default “Revert” snapshot behavior after applying presets be configured in Aegisify WAF, and what is the current default?
read more
Categories: AegisWAF
How does Rule Sets presets: WP Login Protection / XML-RPC Hard Block / WP-JSON Throttle work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
How should Endpoint Policies: override action + categories + thresholds per path (UI uses PRO Mode) be configured in Aegisify WAF, and what is the current default?
read more
Categories: AegisWAF
How does Endpoint Policies framework (per-path policy match + applied logging) work in Aegisify WAF, and what should administrators verify?
read more

What’s New At Aegisify