High-Confidence WordPress Attack Detection Without Pretending Every Pattern Is Malicious
Aegisify WAF 1.20.13 ships a bounded managed signature library for ten common web-attack families, with Balanced and Strict sensitivity, configurable category thresholds, bounded inspection zones, and optional cumulative anomaly scoring.
Ten Attack Families With Explicit Jobs
The current package contains 39 Balanced signatures and adds four Strict-only signatures for a total of 43 in Strict sensitivity.
Click a family to expand
01SQL / NoSQLquery manipulation
02XSSbrowser execution
03Traversal / LFIlocal files
04RFI / RCEremote execution
05Command / SSRFsystem + network
06Uploadsscript filenames
39 Balanced Rules. 43 in Strict. Ten Categories.
The managed library is local and bounded. It should be described accurately rather than marketed as an unlimited live signature feed.
Designed for Higher-Confidence Patterns
Balanced includes six SQLi, four NoSQL, seven XSS, three traversal, three LFI, three RFI, three RCE, three command-injection, four SSRF, and three file-upload signatures.
Four Broader Signatures
Strict adds one additional signature each for SQL statement structure, browser script primitives, NoSQL structural operators, and obfuscated loopback SSRF destinations. Use it only after reviewing representative application traffic.
Enable and Threshold Families Independently
Each family can be enabled separately and has a configurable match threshold. This gives administrators a way to reduce or increase sensitivity for one attack category without weakening the entire WAF.
Current Runtime Requires Active Pro
In the 1.20.13 implementation, the managed evaluation path returns without inspection unless the Pro gate is active. Public documentation should not imply the current managed engine is enforcing these signatures without that active entitlement.
Inspect the Right Request Zones Without Unlimited Work
The engine can evaluate normalized request zones and constrains each inspected haystack to a maximum of 1 MiB.
Headers, Cookies, Body and Normalized Context
Managed Rules uses request zones supplied by the normalizer. WAF settings expose header, cookie and body inspection controls, with a default managed body limit of 65,536 bytes for deeper request-body inspection.
Evaluate Multiple Safe Variants
For each zone, Aegisify evaluates the original value plus variants that remove common SQL-style comments and compact whitespace/control characters. This improves resilience to simple evasion without repeatedly decoding unbounded payloads.
Preserve Rule IDs and Matched Zones
Results include category, matched rule IDs, matched zones, per-rule zone context, match count, threshold, action and message so downstream monitoring and logging can explain what contributed to a decision.
Use Direct Category Thresholds or Optional Cumulative Anomaly Scoring
Aegisify supports two different ways to qualify managed evidence, and they should not be confused.
With cumulative anomaly scoring disabled—the default—a category produces a result when its matched-signature count reaches that category’s configured threshold. The action can be Log, Block, Challenge, or Rate Limit where the surrounding policy permits it.
Pro administrators can optionally enable cumulative managed-rule anomaly scoring. Each unique managed-rule match receives a configurable score, defaulting to 5, and the cumulative threshold defaults to 10. Matches below that anomaly threshold remain log-only evidence; once the threshold is reached, the configured managed action can be returned.
This cumulative option can help require more than one managed signature before action, but it is not machine learning and it is not a historical reputation score. It evaluates the managed evidence present in the current request.
Start With Evidence, Then Increase Sensitivity Deliberately
Signature systems can still match legitimate encoded content, code examples, administrative payloads, page-builder data, imports, APIs, and security-testing traffic.
Begin With Balanced and Log
Exercise login, forms, checkout, REST clients, search, imports, webhooks and administrator workflows. Review which signatures and zones actually match normal site behavior.
Tune the Category or Endpoint
If one workflow creates noise, adjust the relevant category threshold or use an endpoint-specific policy. Avoid disabling Managed Attack Protection site-wide for one legitimate route.
Verify After Enforcement
Compare logs, Overview trends and application behavior after changing action or sensitivity. Keep a rollback path and confirm business-critical traffic still succeeds.
Strict Adds Coverage, but Also Expands the Match Surface
The difference is concrete rather than a vague “more aggressive” switch.
Strict adds four rules: a broader SQL statement-structure signature, browser scripting primitives such as document or window location and common execution calls, additional structural NoSQL operators, and obfuscated numeric loopback forms used in SSRF attempts. Those patterns can be valuable on exposed APIs or high-risk routes, but they also overlap more readily with legitimate technical content, administrative tooling, code examples, and application payloads.
Use endpoint evidence to decide where Strict belongs instead of assuming the strongest global setting creates the best security posture.
Use Managed Signatures as One Evidence Layer, Not the Entire Security Program
Aegisify WAF combines managed signatures with Request Integrity, heuristics, API and application monitoring, authentication defense, bot controls, DDoS protection, logging and Attack Story analysis.
Common Questions
Is this OWASP CRS?
No. Aegisify WAF 1.20.13 contains its own bounded local signature library across ten attack families.
Does Strict mean “more secure” for every WordPress site?
No. Strict adds broader signatures that can increase detection and false-positive risk. Test it against real application traffic before enforcement.
Does a managed-rule match prove exploitation succeeded?
No. A match is request evidence that a known attack pattern was present. Review route, action, application behavior and related evidence before concluding that compromise occurred.
How can Aegisify AI help?
Ask about Aegisify or WordPress: errors, plugins, security, SEO, compatibility, troubleshooting, comparisons, or launch a free website scan.