Managed WordPress WAF Rules: Bounded Signatures, Tunable Thresholds, and Controlled Enforcement
Aegisify WAF 1.20.13 ships a local managed-signature library for common web attack patterns. Balanced mode contains 39 signatures; Strict contains 43 static rule IDs across 10 categories. Administrators can choose inspection zones, category thresholds, optional cumulative scoring, heuristic behavior, endpoint overrides, and effective actions before stronger enforcement is enabled.
From a WordPress Request to a Managed-Rule Decision
The library separates attack categories and request zones so administrators can see what matched and where it matched instead of relying on one combined payload string.
Click a stage to expand
01ZoneRequest context
02VariantNormalize evasion forms
03MatchCategory signatures
04ThresholdPer-category evidence
05ScoreOptional cumulative mode
06PolicyGlobal mode wins
Ten Attack Categories With a Published Local Boundary
The strongest update to the managed-rules story is precision: administrators can know what is in the package instead of assuming an unlimited external rules service.
Database Query Manipulation
Balanced mode includes six SQL-injection signatures and Strict adds one broader rule. The signatures target high-confidence query construction patterns rather than every SQL keyword appearing in content.
Operator and Expression Abuse
Balanced contains four NoSQL-oriented signatures and Strict adds one. This gives API-heavy WordPress applications a separate category instead of treating every data-layer attack as SQL.
Executable Browser Markup
Seven Balanced XSS signatures inspect common executable markup and script constructions, with one additional Strict signature for broader detection.
Traversal, LFI, and RFI
Path Traversal, Local File Inclusion, and Remote File Inclusion each contain three signatures. Keeping them separate supports category-specific thresholds and investigation.
RCE and Command Injection
Remote Code Execution and Command Injection each contain three signatures aimed at server-side execution primitives and shell-style chaining or substitution patterns.
Dangerous Destinations and Executables
SSRF has four Balanced signatures plus one Strict addition; executable file upload has three. These are request-pattern checks and do not claim to prove that a vulnerable server-side sink exists.
Control How Much Request Material Enters Managed Inspection
More inspection is not automatically better if it adds unnecessary PHP work or scans application data that does not need to be evaluated.
PRO controls can include bounded request headers, cookies, and request body in managed inspection. The default maximum body sample is 65,536 bytes and the control can be increased up to 1,048,576 bytes. Aegisify recommends increasing it only for a verified application need because larger limits increase work on the PHP request path.
For each zone, the engine limits the inspected haystack to one megabyte and records which rule IDs matched which zones. That zone evidence is operationally useful: an XSS-like pattern found in a query parameter may deserve different tuning than encoded application state in a cookie or an integration-specific header.
Require More Evidence When One Signature Is Not Enough
The rule library supports two distinct threshold models.
Category Hit Thresholds
Each attack category has an administrator-controlled threshold bounded by the number of available signatures. With cumulative scoring disabled, threshold one allows the first match to own the configured action; a higher value requires multiple independent signatures in that same category.
Optional Cumulative Anomaly Scoring
When enabled, independent managed-rule matches add points across categories. The default configuration is threshold 10 and five points per rule. Below-threshold matches remain log-only even when category evidence exists.
Global WAF Mode Governs the Outcome
The configured finding action supports Log, Challenge, Rate limit, or Block. The authoritative Core WAF mode determines the effective response, allowing teams to collect the same rule evidence without immediately terminating traffic.
Use Endpoint Overrides and Policy Testing Instead of Global Exceptions
A managed library becomes more practical when WordPress paths can be treated according to their actual role.
Endpoint policies can override the managed action, enabled categories, and category thresholds for matching paths. Priority controls determine which policy wins when scopes overlap, while a threshold value of zero can inherit the global threshold. This makes it possible to keep a stricter policy on a sensitive application endpoint without applying that choice everywhere.
The built-in Policy Test can evaluate a synthetic path, method, and sample payload and show endpoint-policy precedence, managed results, heuristic results, custom-rule results, and effective actions without enforcing the test. Protected settings saves use the WAF change guard so policy modifications are verified and can have a rollback snapshot.
How to Use Managed Rules Without Creating Avoidable Outages
A bounded rule library still needs change control on a live WordPress application.
Know What the Rule Library Covers, Then Tune It to Your WordPress Application
Use exact categories, zones, thresholds, endpoint policy, and non-enforcing tests to move from bundled protection to a controlled site-specific WAF policy.
Common Questions About Aegisify Managed Protection
Does Aegisify WAF include OWASP CRS?
No. The 1.20.13 admin interface explicitly describes the managed library as a bounded local signature set and states that it is not OWASP CRS.
Does the plugin receive a live managed-rule feed?
No independent live managed-rule feed is implemented for this local library. Product updates may change packaged signatures, but the current runtime library is local and bounded.
How many managed signatures are included?
The supplied 1.20.13 package contains 39 signatures in Balanced mode and 43 static rule IDs in Strict mode across 10 categories.
Can one endpoint use different thresholds?
Yes. Endpoint policies can override categories, thresholds, and the configured managed action for matching paths, with explicit priority controlling precedence.
How can Aegisify AI help?
Ask about Aegisify or WordPress: errors, plugins, security, SEO, compatibility, troubleshooting, comparisons, or launch a free website scan.