Web Application Firewall Best Practices for VPS

Web Application Firewall Best Practices for VPS

A web application firewall (WAF) inspects HTTP traffic and blocks malicious requests before they reach your application on your Breeze.

Choosing a WAF Strategy

• Embedded WAF - ModSecurity integrated directly with your web server
• Reverse proxy WAF - dedicated proxy filtering traffic before the backend
• Cloud WAF - DNS-based filtering at the edge

Essential Rule Categories

Ensure your WAF ruleset covers these attack types:

• SQL injection and NoSQL injection
• Cross-site scripting (XSS)
• Remote code execution and command injection
• Local and remote file inclusion
• HTTP protocol anomalies and request smuggling

Tuning and Monitoring

Start in detection-only mode and review logs before enforcing blocks:

# Review blocked requests
tail -f /var/log/modsec_audit.log | grep -E "id|msg|uri"

Performance Considerations

• Disable rules that do not apply to your stack (e.g., PHP rules on a Python app)
• Use SecRequestBodyLimit to cap inspected body size
• Cache compiled rulesets for faster processing

Maintenance Schedule

Keep your WAF effective with regular upkeep:

# Update rules weekly
sudo modsecurity-crs-update
sudo systemctl reload apache2

A properly tuned WAF is one of the most effective defenses for web applications running on your Breeze.