WordPress WAF Heuristics: Score Suspicious Request Patterns Without Treating Every Anomaly as an Attack
Aegisify WAF 1.20.13 adds a tunable heuristic layer to managed protection. It examines the normalized content of a request for suspicious encoding, metacharacter density, repeated traversal, dangerous URI schemes, SQL-style tautologies, and unusually long tokens, then acts only when the combined request score reaches the configured threshold.
How One Request Becomes a Heuristic Finding
The heuristic engine runs on normalized request material already prepared by the WAF. Each supported anomaly adds a fixed amount to the request score. A finding is returned only when the configured score threshold is reached.
Click a stage to expand
01NormalizePrepare request text
02MeasureCount suspicious traits
03ScoreAdd fixed evidence points
04ThresholdDefault score 40
05PolicyLog, challenge, limit, block
06EvidenceReason codes + score
Six Deterministic Signals, Each With a Specific Job
The current 1.20.13 implementation is intentionally bounded. It does not create an open-ended behavioral model inside the heuristic class.
High Encoded-Character Volume
The default percent-encoding threshold is eight occurrences. Crossing it contributes 15 points. Encoded content is not automatically malicious, so this signal becomes more useful when paired with other evidence.
Dense Special-Character Use
The engine counts characters commonly associated with markup, shell syntax, quoting, separators, and expression construction. Twelve or more by default contributes 20 points.
Repeated Parent-Directory Sequences
Two or more direct ../ or Windows-style parent-directory sequences add 20 points, giving repeated traversal behavior more weight than one incidental path token.
file, gopher, or dict URI Use
Requests containing selected schemes that can be relevant to file access or server-side request abuse add 20 points. This is evidence, not proof that a vulnerable sink exists.
Simple Always-True Expression Pattern
A basic OR/AND numeric tautology pattern contributes 25 points. It is deliberately one signal within the broader WAF rather than a replacement for the managed SQL-injection signatures.
Unusually Large Single Token
A token at or above 900 characters by default contributes 20 points. Administrators can raise or lower that threshold from 100 through 5,000 characters to fit legitimate application payloads.
Thresholds Matter More Than a Generic “Aggressiveness” Label
Aegisify exposes the controls that determine when the heuristic layer becomes actionable.
Default: 40
The score threshold determines when a heuristic finding exists. Raising it requires more combined evidence. Lowering it increases sensitivity and should be validated against real forms, APIs, editors, and encoded application traffic.
8 Encodings · 12 Metacharacters · 900-Character Token
These defaults can be tuned independently. That matters because legitimate technical applications may use encoded values or long tokens more often than a conventional publishing site.
Default Recommendation: Log
The admin interface recommends keeping heuristics in Log while learning site behavior. Challenge, rate limiting, or blocking should follow evidence showing the selected threshold is reliable for that environment.
Do Not Confuse Two Different WAF Scoring Systems
Aegisify 1.20.13 uses heuristic scoring and optional cumulative managed-rule scoring for different purposes.
Heuristic scoring evaluates broad traits inside one normalized request. Its output uses the heuristic rule identifier heur_01 and provides reason codes such as high percent encoding, many metacharacters, traversal repetition, dangerous schemes, tautology, or a very long token.
Cumulative managed-rule scoring is separate. When enabled, it combines independent exact managed-signature matches across the bounded managed library. Its default configuration is disabled, with an action threshold of 10 and five points per independent signature match.
Observe and Learn Can Keep a Strong Configured Action From Terminating Traffic
The heuristic layer participates in the Core WAF policy rather than bypassing it.
Start in Observe or Learn
The current administration guidance explicitly recommends enabling heuristics while the WAF is in a non-terminating mode. Review which routes, payload types, and applications reach the heuristic threshold before increasing enforcement.
Tune the Signal That Is Actually Noisy
If legitimate traffic crosses the threshold, adjust the relevant encoding, metacharacter, token-length, or total-score setting instead of automatically disabling the whole WAF or excluding a large application path.
Move to Stronger Action Only With Evidence
When site-specific review shows a threshold reliably identifies abusive input, administrators can choose Challenge, Rate limit, or Block. The authoritative global WAF mode still determines the effective terminating behavior.
What This Layer Does—and What It Does Not Do
Clear boundaries make the feature more useful and the security claim more defensible.
Use Heuristic Evidence to Strengthen WordPress WAF Decisions
Start with real application traffic, review which anomaly combinations matter, then tighten enforcement without turning one unusual request into automatic certainty.
Common Questions About Aegisify WAF Heuristics
Does Aegisify’s heuristic engine learn automatically over time?
No. The 1.20.13 heuristic class is deterministic and request-scoped. Other WAF controls correlate activity across requests, but this layer uses fixed signals and administrator-controlled thresholds.
What happens below the score threshold?
The heuristic evaluator returns no finding when the request score remains below the configured threshold. This prevents one low-value anomaly from automatically becoming a heuristic event.
Should I set the heuristic action to Block immediately?
The current product guidance recommends Log first, preferably while the Core WAF is in Observe or Learn. Review legitimate application traffic before moving broad anomaly detection to a terminating action.
Is heuristic scoring the same as managed-rule anomaly scoring?
No. Heuristics score broad characteristics of one normalized request. Managed cumulative scoring separately combines independent signature matches from the bundled managed-rule library.
How can Aegisify AI help?
Ask about Aegisify or WordPress: errors, plugins, security, SEO, compatibility, troubleshooting, comparisons, or launch a free website scan.