How should JS Challenge Token support (challenge + TTL settings) be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should JS Challenge Token support (challenge + TTL settings) be configured in Aegisify WAF, and what is the current default? is part of the WAF request-inspection, enforcement, visibility, or exception-management surface. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely ai_security.consumption.characters_per_token 4 The shipped value of 4 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ai_security.consumption.daily_input_token_budget 250000 The shipped value of 250000 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ai_security.consumption.daily_output_token_budget 250000 The shipped value of 250000 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.emergency_minimums.challenge 3 The shipped value of 3 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.admin_ajax.challenge 120 The shipped value of 120 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.cache_bypass.challenge 40 The shipped value of 40 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.global.challenge 300 The shipped value of 300 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.groups.rest.challenge 160 The shipped value of 160 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, challenge, js, support, token, ttl, ai_security, consumption, characters_per_token, daily_input_token_budget, daily_output_token_budget, ddos, emergency_minimums, groups, admin_ajax Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How should Heuristic tuning (score threshold, encoding threshold, meta threshold, token length) be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should Heuristic tuning (score threshold, encoding threshold, meta threshold, token length) be configured in Aegisify WAF, and what is the current default? is part of the WAF request-inspection, enforcement, visibility, or exception-management surface. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.thresholds.heuristic 50 The shipped value of 50 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. managed_rules.heuristics.action log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. managed_rules.heuristics.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.heuristics.meta_threshold 12 The shipped value of 12 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. managed_rules.heuristics.pct_threshold 8 The shipped value of 8 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. managed_rules.heuristics.score_threshold 40 The shipped value of 40 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. managed_rules.heuristics.token_len_threshold 900 The shipped value of 900 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, encoding, heuristic, length, meta, score, threshold, token, tuning, managed_rules, thresholds, heuristics, action, enabled, meta_threshold Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Heuristic layer evaluation (request scoring layer runs in engine) work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Heuristic layer evaluation (request scoring layer runs in engine) work in Aegisify WAF, and what should administrators verify? is part of the WAF request-inspection, enforcement, visibility, or exception-management surface. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.thresholds.heuristic 50 The shipped value of 50 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. managed_rules.heuristics.action log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. managed_rules.heuristics.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.heuristics.meta_threshold 12 The shipped value of 12 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. managed_rules.heuristics.pct_threshold 8 The shipped value of 8 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. managed_rules.heuristics.score_threshold 40 The shipped value of 40 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. managed_rules.heuristics.token_len_threshold 900 The shipped value of 900 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. For abuse/rate thresholds, a lower number is generally more aggressive and can stop attacks sooner but may affect legitimate bursts; a higher number is more tolerant but allows more activity before intervention. Change incrementally and validate against logs. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, engine, evaluation, heuristic, layer, request, runs, scoring, managed_rules, thresholds, heuristics, action, enabled, meta_threshold, pct_threshold Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

What are the current Free and Pro managed-rule actions in Aegisify WAF 1.20.13, and how does global WAF mode affect enforcement?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary What are the current Free and Pro managed-rule actions in Aegisify WAF 1.20.13, and how does global WAF mode affect enforcement? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Current-version correction Do not use the old blanket statement that Free is always forced to Log. WAF 1.20.13 stores separate managed_rules.mode_free and managed_rules.mode_pro values and the current storage/UI default for both is Block . The authoritative global WAF rollout mode can still downgrade effective enforcement while the site is in Observe or Learn, which is why administrators should review non-blocking evidence before enabling global enforcement. A legacy fallback to Log exists only when an older/missing Free mode value is encountered in certain code paths; it is not the current shipped stored default. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely waf.mode observe “observe” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. managed_rules.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.mode_free block Block is the shipped enforcement choice for this specific control, indicating that the current product considers a positive match sufficiently high confidence to stop by default. Where this control exposes Off / Monitor / Block: Off disables its decision path; Monitor records/evaluates without blocking; Block enforces the decision. Start with Monitor for uncertain traffic, then move to Block after reviewing false positives and exceptions. managed_rules.mode_pro block Block is the shipped enforcement choice for this specific control, indicating that the current product considers a positive match sufficiently high confidence to stop by default. Where this control exposes Off / Monitor / Block: Off disables its decision path; Monitor records/evaluates without blocking; Block enforces the decision. Start with Monitor for uncertain traffic, then move to Block after reviewing false positives and exceptions. managed_rules.sensitivity balanced “balanced” is the shipped baseline and is the closest current code-defined baseline/medium operating point. Use stricter behavior only after reviewing site-specific evidence. Treat the shipped value as the baseline/medium operating point. A stricter profile generally increases sensitivity and may increase false positives or workload; a more permissive profile generally reduces intervention but can allow more unwanted activity. managed_rules.challenge.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, abuse, action, audit, block, challenge, ddos, event, events, forced, limit, log, logging, logs, max Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How should Sensitivity mode: balanced / strict (signature pack selection) be configured in Aegisify WAF, and what is the current default?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How should Sensitivity mode: balanced / strict (signature pack selection) be configured in Aegisify WAF, and what is the current default? is part of the WAF request-inspection, enforcement, visibility, or exception-management surface. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely ai_security.mode monitor “monitor” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Where this control exposes Off / Monitor / Block: Off disables its decision path; Monitor records/evaluates without blocking; Block enforces the decision. Start with Monitor for uncertain traffic, then move to Block after reviewing false positives and exceptions. app_monitoring.mode_schema_version 2 The shipped value of 2 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ddos.emergency_mode OFF / false Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. managed_rules.mode_free block Block is the shipped enforcement choice for this specific control, indicating that the current product considers a positive match sufficiently high confidence to stop by default. Where this control exposes Off / Monitor / Block: Off disables its decision path; Monitor records/evaluates without blocking; Block enforces the decision. Start with Monitor for uncertain traffic, then move to Block after reviewing false positives and exceptions. managed_rules.mode_pro block Block is the shipped enforcement choice for this specific control, indicating that the current product considers a positive match sufficiently high confidence to stop by default. Where this control exposes Off / Monitor / Block: Off disables its decision path; Monitor records/evaluates without blocking; Block enforces the decision. Start with Monitor for uncertain traffic, then move to Block after reviewing false positives and exceptions. managed_rules.sensitivity balanced “balanced” is the shipped baseline and is the closest current code-defined baseline/medium operating point. Use stricter behavior only after reviewing site-specific evidence. Treat the shipped value as the baseline/medium operating point. A stricter profile generally increases sensitivity and may increase false positives or workload; a more permissive profile generally reduces intervention but can allow more unwanted activity. waf.mode observe “observe” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. ai_security.audit.include_provider_model ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance Use the feature’s logs and current request evidence as the tuning source. Compare normal traffic with the event that triggered the control, then change only the smallest setting required. Technical keywords Aegisify WAF, 1.20.13, balanced, mode, pack, selection, sensitivity, signature, strict, ai_security, app_monitoring, mode_schema_version, ddos, emergency_mode, managed_rules, mode_free Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Managed Rule categories (PRO-only enforcement): RCE / Command Injection / SSRF / File Upload work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Managed Rule categories (PRO-only enforcement): RCE / Command Injection / SSRF / File Upload work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.mode_pro block Block is the shipped enforcement choice for this specific control, indicating that the current product considers a positive match sufficiently high confidence to stop by default. Where this control exposes Off / Monitor / Block: Off disables its decision path; Monitor records/evaluates without blocking; Block enforces the decision. Start with Monitor for uncertain traffic, then move to Block after reviewing false positives and exceptions. managed_rules.sensitivity balanced “balanced” is the shipped baseline and is the closest current code-defined baseline/medium operating point. Use stricter behavior only after reviewing site-specific evidence. Treat the shipped value as the baseline/medium operating point. A stricter profile generally increases sensitivity and may increase false positives or workload; a more permissive profile generally reduces intervention but can allow more unwanted activity. managed_rules.categories.sqli ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.categories.xss ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.categories.rce ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.categories.path_traversal ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.categories.ssrf ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, categories, command, custom, enforcement, file, injection, managed, only, rce, rule, rules, signature, ssrf, upload Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

Which managed-rule attack categories are active in Aegisify WAF 1.20.13, and are managed signatures Pro-gated?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary Which managed-rule attack categories are active in Aegisify WAF 1.20.13, and are managed signatures Pro-gated? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Current-version correction The old “always available” Free/Pro category split is not current WAF 1.20.13 behavior. The supplied managed-signature engine returns without evaluating any managed signatures unless AegisWAF_Pro_Gate::is_active() is true. Therefore SQL injection, XSS, path traversal, RCE, LFI/RFI, SSRF, command injection, NoSQL injection, file-upload, and related managed signature categories should be documented as part of the current Pro-gated managed-rule engine, not as a guaranteed Free subset. Custom rules and other WAF layers have their own separate license/behavior rules. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.mode_pro block Block is the shipped enforcement choice for this specific control, indicating that the current product considers a positive match sufficiently high confidence to stop by default. Where this control exposes Off / Monitor / Block: Off disables its decision path; Monitor records/evaluates without blocking; Block enforces the decision. Start with Monitor for uncertain traffic, then move to Block after reviewing false positives and exceptions. managed_rules.sensitivity balanced “balanced” is the shipped baseline and is the closest current code-defined baseline/medium operating point. Use stricter behavior only after reviewing site-specific evidence. Treat the shipped value as the baseline/medium operating point. A stricter profile generally increases sensitivity and may increase false positives or workload; a more permissive profile generally reduces intervention but can allow more unwanted activity. managed_rules.categories.sqli ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.categories.xss ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.categories.rce ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.categories.path_traversal ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.categories.ssrf ON / true Enabled in the shipped baseline as the product’s current safe operating choice for this control. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, always, available, categories, custom, managed, path, rule, rules, signature, sqli, traversal, xss, managed_rules, enabled Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

When should administrators use Managed Rules engine enabled toggle in Aegisify WAF?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary When should administrators use Managed Rules engine enabled toggle in Aegisify WAF? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely managed_rules.anomaly_scoring.enabled OFF / false Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. managed_rules.challenge.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. managed_rules.heuristics.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. rules.enabled ON / true Enabled in the shipped baseline because the control provides broadly useful visibility, validation, compatibility, or protection without requiring a site-specific value. ON activates the behavior; OFF removes that specific behavior. Use OFF only when the control is intentionally unnecessary, another trusted layer owns the function, or a compatibility investigation proves the control is involved. Re-enable after testing when protection is still required. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.allowed_actions Allowed values: ["log","block","skip_waf"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. custom_rules.allowed_methods Allowed values: ["ANY","GET","POST","PUT","PATCH","DELETE","HEAD","OPTIONS"] This list is the current accepted-value set enforced by the supplied implementation. Choose only from the supported set. Narrower methods/actions reduce unintended scope; unsupported values are normalized or rejected by the current implementation. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, custom, enabled, engine, managed, rule, rules, signature, toggle, managed_rules, anomaly_scoring, challenge, heuristics, custom_rules, action_default Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How many custom rules can Free and Pro save in Aegisify WAF 1.20.13, and is there a five-rule runtime evaluation cap?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How many custom rules can Free and Pro save in Aegisify WAF 1.20.13, and is there a five-rule runtime evaluation cap? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Current-version correction The old wording is incorrect as an engine-level “evaluate only the first five” cap. In WAF 1.20.13 the wp-admin custom-rule save path accepts up to 5 rows for Free and 50 rows for Pro . The runtime rule engine then orders the stored enabled rules by numeric priority and selects the first rule whose method, path, and configured predicates match; it does not apply a second per-request “first five only” evaluation gate. Pro rule import is separately limited to 512 KB and the first 100 imported rows. Custom-rule mechanics and limits Custom rules use explicit numeric priority; lower values run first. The current UI accepts priorities from 1 through 9,999 and uses 100 as the base/default when a priority is absent. HTTP method defaults to ANY and can be narrowed to GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS. The safe action default is Log; Block terminates validated matches, while Skip Core WAF inspection is a narrow compatibility exclusion that bypasses the remaining Core WAF layers for that matching request. Regex conditions are Pro-only in the current editor; invalid regular expressions prevent the ruleset from being saved/imported. Root-wide or global Core WAF exclusions are rejected. Free save is bounded to 5 rows; Pro save to 50 rows. Pro JSON import is bounded to 512 KB and the first 100 rows. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely custom_rules.free_max_rows Maximum: 5 5 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.pro_max_rows Maximum: 50 50 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.import_max_bytes Maximum: 524288 524288 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.import_max_rules Maximum: 100 100 is the current code-enforced maximum/capacity boundary for this control, not a normal operating default. Do not treat this cap as a target. Operate below it unless the legitimate site requirement needs more capacity; reaching the cap means the current implementation will clamp, truncate, stop adding rows, or reject additional input depending on the control. custom_rules.priority_default 100 The shipped value of 100 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. custom_rules.method_default ANY “ANY” is the exact shipped value in the current version. It is preserved as the baseline because the plugin code defines it as the default rather than deriving it from the old FAQ text. Keep the shipped value unless a documented site requirement calls for a different mode or identifier. Validate the change in the feature’s logs/status view and roll back if behavior becomes less reliable. custom_rules.action_default log “log” is the shipped baseline so administrators can collect evidence and verify normal traffic or behavior before moving to stronger enforcement where applicable. Use the shipped observation mode while establishing a baseline. Move toward enforcement only when logs show the signal is reliable. Returning to monitor/observe is preferable to disabling a control entirely during false-positive tuning. custom_rules.regex_requires_pro PRO required The current UI/save path makes this capability license-gated rather than a site-tuning default. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, cap, custom, enabled, enforcement, engine, evaluated, first, hard, managed, only, rule, rules, signature, custom_rules Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

How does Regex conditions (one regex per line) — enforced only in PRO work in Aegisify WAF, and what should administrators verify?

body.single-avada_faq h1.entry-title, body.single-avada_faq .entry-title, .fusion-faq-shortcode .fusion-toggle-heading, .fusion-faq-shortcode .panel-title a, .fusion-accordian .panel-title, .fusion-accordian .panel-title a {font-size:14px!important;color:#2d2e3d!important;} .aegisify-faq-tech,.aegisify-faq-tech p,.aegisify-faq-tech li,.aegisify-faq-tech td,.aegisify-faq-tech th,.aegisify-faq-tech code {font-size:11.5px!important;color:#2d2e3d!important;line-height:1.65;} .aegisify-faq-tech h2 {font-size:14px!important;color:#2d2e3d!important;line-height:1.4;margin:20px 0 8px;} .aegisify-faq-tech h3 {font-size:12.5px!important;color:#2d2e3d!important;line-height:1.45;margin:16px 0 6px;} .aegisify-faq-tech table {width:100%;border-collapse:collapse;margin:10px 0 14px;} .aegisify-faq-tech th,.aegisify-faq-tech td {vertical-align:top;text-align:left;border:1px solid #dedfe3;padding:7px 8px;} .aegisify-faq-tech code {overflow-wrap:anywhere;word-break:break-word;} Technical summary How does Regex conditions (one regex per line) — enforced only in PRO work in Aegisify WAF, and what should administrators verify? controls deterministic request inspection and matching for common web-attack techniques, custom rules, managed signatures, and heuristics. This article is grounded in the supplied Aegisify WAF 1.20.13 plugin package. It documents current behavior and defaults rather than relying on older FAQ wording. Where administrators configure or verify it Primary wp-admin path: wp-admin → Aegisify WAF → WAF Rules / Settings. Exact controls can be distributed across the related tab/page when the feature is composed of multiple engines. Current 1.20.13 defaults and related controls The table below lists settings in the supplied current source that are directly related to this topic. The current default/bound/status shown is code-derived. Where the product does not define a named Medium preset, the shipped default is documented as the baseline operating point rather than inventing a value. Setting Current default / bound / status Why this default How to tune safely ai_security.consumption.characters_per_token 4 The shipped value of 4 is the exact current default encoded by the plugin and should be treated as the baseline unless site evidence supports a change. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. ai_security.consumption.input_cost_per_million_cents 0 Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. ai_security.consumption.output_cost_per_million_cents 0 Disabled in the shipped baseline because enabling it can change live request handling, indexing behavior, automation, enforcement, or integration traffic and should be reviewed for the specific site first. OFF leaves the behavior inactive. Turn it ON only after checking prerequisites and expected traffic/content because this setting can introduce enforcement, automation, indexing, outbound integration, or additional processing depending on the feature. ai_security.consumption.requests_per_minute 30 The shipped value of 30 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. app_monitoring.target_rows_per_page 25 The shipped value of 25 is the current baseline threshold or capacity. It is intentionally finite so the control can provide useful protection or bounded resource use without starting at an extreme. Treat this numeric value as the shipped baseline. Adjust one step at a time, document the reason, and verify the operational effect before making the setting more extreme. bot.default_limit_per_min Minimum: 180 180 is the current code-enforced minimum boundary, not a recommended default. Values below it are clamped or rejected by the current save path. Do not tune below this boundary. Adjust the corresponding primary setting at or above this minimum and validate legitimate traffic/workload. bot.per_path_limits [] Blank or empty by default because this value depends on the site, organization, route, identity source, recipient, API credential, or exception policy. Configure it only with verified site-specific data. Supply only validated site-specific values. Leaving it blank/empty means no custom value, exception, recipient, credential, route, or policy has been asserted by default. custom_rules.regex_requires_pro PRO required The current UI/save path makes this capability license-gated rather than a site-tuning default. This row documents fixed current-version behavior or a capability boundary. Change the related user-facing setting rather than attempting to tune this reference value. Adjustment strategy Change one control at a time, save it through the product UI, reproduce the legitimate and malicious/test flow, and review the product log/status surface. For enforcement controls, use Monitor/Observe first when normal behavior is uncertain; move to Block only after the signal is reliable. For thresholds, do not jump directly from the default to an extreme unless an active incident requires emergency containment and a recovery path exists. Operational guidance On a production WordPress site, a sudden block spike after a plugin/API deployment should first be investigated in WAF logs. Narrow the issue to the exact route, rule family, client identity, or payload characteristic. Prefer a precise exclusion/allowlist or threshold adjustment over disabling broad protection. Technical keywords Aegisify WAF, 1.20.13, conditions, enforced, line, one, only, per, regex, ai_security, consumption, characters_per_token, input_cost_per_million_cents, output_cost_per_million_cents, requests_per_minute, app_monitoring Source baseline Verified package: Aegisify WAF 1.20.13. Primary source files: includes/class-aegiswaf-storage.php; includes/class-aegiswaf-ai-security.php; includes/class-aegiswaf-api-security.php; includes/class-aegiswaf-managed-rules.php; includes/ddos/class-aegiswaf-ddos-storage.php; includes/admin/pages/class-aegiswaf-page-waf-rules.php; includes/admin/pages/class-aegiswaf-page-logs.php; includes/admin/pages/class-aegiswaf-page-access.php. If a future plugin version changes these settings, support should re-read the installed version rather than carry these defaults forward automatically.

Archives: FAQs | Aegisify - WordPress Tools, Security…

Categories: AegisWAF
How should JS Challenge Token support (challenge + TTL settings) be configured in Aegisify WAF, and what is the current default?
read more
Categories: AegisWAF
How should Heuristic tuning (score threshold, encoding threshold, meta threshold, token length) be configured in Aegisify WAF, and what is the current default?
read more
Categories: AegisWAF
How does Heuristic layer evaluation (request scoring layer runs in engine) work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
What are the current Free and Pro managed-rule actions in Aegisify WAF 1.20.13, and how does global WAF mode affect enforcement?
read more
Categories: AegisWAF
How should Sensitivity mode: balanced / strict (signature pack selection) be configured in Aegisify WAF, and what is the current default?
read more
Categories: AegisWAF
How does Managed Rule categories (PRO-only enforcement): RCE / Command Injection / SSRF / File Upload work in Aegisify WAF, and what should administrators verify?
read more
Categories: AegisWAF
Which managed-rule attack categories are active in Aegisify WAF 1.20.13, and are managed signatures Pro-gated?
read more
Categories: AegisWAF
When should administrators use Managed Rules engine enabled toggle in Aegisify WAF?
read more
Categories: AegisWAF
How many custom rules can Free and Pro save in Aegisify WAF 1.20.13, and is there a five-rule runtime evaluation cap?
read more
Categories: AegisWAF
How does Regex conditions (one regex per line) — enforced only in PRO work in Aegisify WAF, and what should administrators verify?
read more

What’s New At Aegisify