> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/web-ddos/interface/waf-rules.md).

# WAF Rules

Link11 Zero Touch WAF cleans traffic by enforcing Rules (which are essentially threat signatures). A request that matches one of the signatures will normally be blocked.

However, this is not necessarily desirable in all circumstances. Therefore, Link11 gives admins the ability to disable Rule enforcement at various scopes:

* Disable specific Rules for an entire instance ([Link11 Rules](#id-webddos-wafrules-link11rules))
* Disable specific Rules for specific paths within an instance ([Disabled Path Specific Rules](#id-webddos-wafrules-pathspecificrules))
* Disable the WAF completely for specific URLs ([WAF URL Whitelist](#waf-url-whitelist))

{% hint style="info" %}
To exempt URLs from **all** Link11 mitigation (DDoS, WAF, and Bot Management), add them to the [URL Whitelist](/product-guides/web-ddos/interface/url-whitelist.md).
{% endhint %}

## Link11 Rules <a href="#id-webddos-wafrules-link11rules" id="id-webddos-wafrules-link11rules"></a>

Disabling Rule(s) here means that all traffic to the instance will be exempted from being blocked by those Rule(s), even if they match the Rule criteria.

<figure><img src="/files/XN09JVMAgWehrlSRionV" alt=""><figcaption></figcaption></figure>

### **Instance selection**

Clicking on the dropdown menu lets admins select the instance which needs Rule(s) to be disabled.

<div align="left"><figure><img src="/files/ZqH5aN0ymvNH3h8WwpbO" alt=""><figcaption></figcaption></figure></div>

***

### **Search Bar**

Looks through the Rule IDs and Rule Message descriptions (does not look through tags).

<figure><img src="/files/oboCKRADmZ0xhgrEAiM7" alt=""><figcaption></figcaption></figure>

***

### **WAF Logs**

<div align="left"><figure><img src="/files/5MSHfDfpUBpbaA3wHAdp" alt=""><figcaption></figcaption></figure></div>

Redirects to [WAF Logs](/product-guides/web-ddos/interface/waf-logs.md).

***

### **Rules display filter**

<div align="left"><figure><img src="/files/R7W0ERIrSbOWiVbLAEX9" alt=""><figcaption></figcaption></figure></div>

Determines whether the display shows all Rules, or only disabled Rules.

***

### **Rules list**

Lists all Rules that are configured, and gives the option to disable them by clicking on the “Disable” button.

<figure><img src="/files/h9cypJMWFPgWrvG4I7bf" alt=""><figcaption></figcaption></figure>

***

## Disabled Path Specific Rules <a href="#id-webddos-wafrules-pathspecificrules" id="id-webddos-wafrules-pathspecificrules"></a>

<figure><img src="/files/MUyXnCUfrRs1riSmLlao" alt=""><figcaption></figcaption></figure>

Rules disabled here will only apply to requests that are made to the specified URL paths. The URL paths can be defined for one or more instances.

### Add Path

Selecting this button will open the following dialog.

<figure><img src="/files/g2hF6B6eEzYHdB1EQbnI" alt=""><figcaption></figcaption></figure>

#### **Path**

The URL path to which the whitelisting should be limited.

***

#### **Type**

**Exact**: Matches the URL Path exactly and does not include any query parameters

*Example*: /example/test

| Request                                                                                   | Match |
| ----------------------------------------------------------------------------------------- | ----- |
| [www.testdomain.com/example/test](http://www.testdomain.com/example/test)                 | Yes   |
| [www.testdomain.com/example/test?id=1575](http://www.testdomain.com/example/test?id=1575) | No    |
| [www.testdomain.com/example/test/test2](http://www.testdomain.com/example/test/test2)     | No    |

**Begins With**: Matches the URL Path and anything that follows it

*Example*: /example/test

| Request                                                                                   | Match |
| ----------------------------------------------------------------------------------------- | ----- |
| [www.testdomain.com/example/test](http://www.testdomain.com/example/test)                 | Yes   |
| [www.testdomain.com/example/test?id=1575](http://www.testdomain.com/example/test?id=1575) | Yes   |
| [www.testdomain.com/example/test/test2](http://www.testdomain.com/example/test/test2)     | Yes   |
| [www.testdomain.com/example/admin](http://www.testdomain.com/example/admin)               | No    |

The *Exact* type will be checked first, and the rules for an *Exact* type path will be used even if there is a *Begins With* type path that would also match the request.

*Begins With* type paths can overlap. If multiple *Begins With* type oaths match a request, all of the rules from all of the paths will be applied.

***

### **Instance**

Select the instance this rule should be applied to

***

### **Rules**

The WAF rules that should be whitelisted on this path

***

### **Date Added**

The date the Rule was added to the path

***

### **Rule ID**

The Rule IDs that have been whitelisted on this path

***

### **Message**

The description of the Rule as provided by ModSecurity

***

### **Tags**

The type of this rule. The Tags identify what sort of exploits this rule prevents

***

## **WAF URL Whitelist**

For customers that need to disable WAF completely on a certain path, we offer a URL Whitelisting feature. This feature supports both Exact and Recursive (Begins With) paths.&#x20;

To configure this option, please reach out to <support@link11.com> with the following information:

Path: *The path that should be whitelisted against WAF. The path should be complete, including the hostname (domain) that the path should be applied to.*

Type: *Either Exact or “Begins With”*

Instance: *The Link11 instance name or IP address that this rule needs to be applied on.*