ShieldGate Docs

WAF policies

Policy modes and actions

Enforce, Detect, Simulate, Test—and what each action does.

Goal

Choose the right mode and action so you can roll out WAF rules safely.

Modes

Mode Live traffic behavior
Enforce Applies blocking / redirect / ban actions
Detect Evaluates and logs; allows the request
Simulate Similar learning/logging posture; allows
Test Skipped on the live request path

Learning tip: start new rule packs in Detect or Simulate, watch Analytics / security events, then flip to Enforce.

Actions

Common actions:

  • Allow, Block, LogOnly, Redirect, Rewrite
  • IncreaseThreatScore
  • RateLimit, TemporaryBan, PermanentBan
  • Challenge, CaptchaHook
  • CustomPluginAction

Action parameters are JSON (for example temporary ban duration, rate-limit policy id).

Steps

  1. Open Security → Policies.
  2. Create or edit a rule; pick mode and action.
  3. Attach an expression (see JSON AST rules).
  4. Save; prefer Detect first in production tenants.

Verify

  • Detect mode: security events appear without user-facing blocks.
  • Enforce mode: blocked requests return the configured deny behavior.