---
title: "Put a web application firewall and flood · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/waf-and-ddos
id: INF-86
level: Recommended
applies: hosted
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1168
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Put a web application firewall and flood protection in front of public services

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-86
- Level: Recommended
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md)
- Rule: Route every public website and API through an edge with flood protection and a web application firewall. Start the firewall's managed rules in count mode, then block once false positives are fixed.
- Check: The DNS for every public host points at the edge. The firewall policy is in code, in block mode, with a managed rule set and a rate rule. A test request with a common attack string, such as `?q=<script>alert(1)</script>`, is blocked at the edge and logged.
- Applies when: The project runs a hosted website or online service.
- How: A flood of traffic fills a server's link or its connection table long before the app sees a request. An edge network or the cloud's own protection, such as AWS Shield or Google Cloud Armor, absorbs floods at network level. A web application firewall then filters requests with rate rules per address and managed rule sets, such as the OWASP Core Rule Set. It buys time, but it never replaces fixing the hole in the code. Run new rules in count mode for 7 days, read what they would have blocked, and add exceptions for named paths. Keep the origin reachable only from the edge, as [Let only your edge network reach the origin](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/origin-behind-edge.md) says. Per-client limits stay in the app, as [Limit how often anyone can call your APIs](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/rate-limits.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Terraform example

```hcl
resource "aws_wafv2_web_acl" "shop" {
  name  = "shop-edge"
  scope = "CLOUDFRONT"
  default_action { allow {} }

  rule {
    name     = "common-attacks"
    priority = 1
    override_action { none {} }
    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "common-attacks"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "shop-edge"
    sampled_requests_enabled   = true
  }
}
```

### Shell example

```sh
# Expect 403 from the edge, and a matching entry in the firewall log
curl -s -o /dev/null -w '%{http_code}\n' 'https://shop.example.com/search?q=<script>alert(1)</script>'
```

## Sources

- [CISA, Understanding and Responding to DDoS Attacks](https://www.cisa.gov/sites/default/files/publications/understanding-and-responding-to-ddos-attacks_508c.pdf)
- [OWASP ModSecurity Core Rule Set](https://owasp.org/www-project-modsecurity-core-rule-set/)
- [AWS WAF managed rule groups](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups.html)

## Related rules

- INF-71 [Let only your edge network reach the origin](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/origin-behind-edge.md) in Infrastructure and environments
- APS-49 [Limit how often anyone can call your APIs](https://agentwranglers.se/playbook/application-security/limits-and-business-logic/rate-limits.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/networking-and-dns/waf-and-ddos">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Let only your edge network reach the origin](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/origin-behind-edge.md)
- Next: [Reach managed services over private endpoints](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-endpoints.md)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns.md)