---
title: "Web application and API protection"
description: "WAF policies for adult platforms: OWASP-style rules, custom rules, rate limiting, IP controls, TLS fingerprinting, L7 DDoS defence, and monitor versus block modes."
url: "https://adultinfra.com/docs/security/waf/"
dateModified: "2026-09-12"
---

[Home](https://adultinfra.com/) / [Docs](https://adultinfra.com/docs/) / Security 

# Web application and API protection

WAF policies for adult platforms: OWASP-style rules, custom rules, rate limiting, IP controls, TLS fingerprinting, L7 DDoS defence, and monitor versus block modes.

LAST REVIEWED 2026-09-13

ON THIS PAGE

- [Policy structure](https://adultinfra.com/docs/security/waf/#policy-structure)
- [OWASP-style rules](https://adultinfra.com/docs/security/waf/#owasp-style-rules)
- [Custom rules](https://adultinfra.com/docs/security/waf/#custom-rules)
- [Rate limiting](https://adultinfra.com/docs/security/waf/#rate-limiting)
- [IP allow and deny](https://adultinfra.com/docs/security/waf/#ip-allow-and-deny)
- [TLS and protocol fingerprinting](https://adultinfra.com/docs/security/waf/#tls-and-protocol-fingerprinting)
- [Layer-7 DDoS and the login surface](https://adultinfra.com/docs/security/waf/#layer-7-ddos-and-the-login-surface)
- [Monitor versus block](https://adultinfra.com/docs/security/waf/#monitor-versus-block)
- [Where AdultInfra fits](https://adultinfra.com/docs/security/waf/#where-adultinfra-fits) 

**Web application and API protection (WAF)** inspects HTTP requests at the edge and decides, per request, whether to allow, challenge, rate-limit, or block. It is the layer that protects the parts of an adult platform that caching cannot: login, signup, search, payment and payout endpoints, and account APIs. Volumetric and layer-4 attacks are handled separately. See [DDoS protection](https://adultinfra.com/docs/security/ddos-protection/). The WAF addresses layer-7 abuse that looks like real traffic.

## Policy structure

A WAF policy is an ordered set of rules evaluated against each request, ending in a default action. Keep it legible:

- **A small number of high-signal rules**, not a giant imported list you never review.

- **Explicit ordering**, because the first matching block or allow wins. Allow rules for trusted internal callers should be deliberate and narrow.

- **A named default action:** usually allow for public content and deny for sensitive paths that should never receive unexpected input.

- **Per-route scoping.** Login, search, payment, and media should not share one policy. A rule that makes sense for a media path can break checkout.

## OWASP-style rules

Baseline coverage follows the OWASP Top 10 categories: injection, broken access control attempts, cross-site scripting, insecure deserialisation patterns, and common scanner signatures. These managed rule sets are a floor, not a ceiling. Two cautions for adult platforms:

- **Tune before enforcing.** Generic rules generate false positives on search terms, long URLs, and media parameters. Run in monitor mode first and review what they would have blocked.

- **Watch the search surface.** Adult search traffic contains terms that look hostile to naive regex. Over-broad rules will block legitimate queries and create support load.

## Custom rules

The rules that matter most are the ones specific to your application:

- Block requests that hit admin or debug paths from the public internet.

- Enforce expected content types and body shapes on API endpoints.

- Reject unexpected HTTP methods on read-only routes. See [Edge access policy](https://adultinfra.com/docs/security/access-policy/).

- Rate-limit per account, per IP, and per path pattern on credential and payment flows.

Keep custom rules versioned and tested against a sample of real traffic before enforcement.

## Rate limiting

Rate limiting is the highest-value control on any platform with accounts. Design it around the resource you are protecting:

- **Per-IP and per-subnet** limits for anonymous abuse.

- **Per-account and per-token** limits for authenticated abuse, which IP limits miss entirely when attackers rotate addresses.

- **Path-specific budgets:** a strict ceiling on login, signup, password-reset, and payout endpoints; a generous ceiling on media.

- **Cost-aware limits** on endpoints that trigger origin work: search, transcoding requests, exports.

Return `429` with a `Retry-After` and apply limits at the edge so abusive traffic never reaches origin.

## IP allow and deny

IP lists are a blunt instrument but useful for a few jobs: allowlisting partner and internal ranges, denying known-bad sources, and protecting admin surfaces. They are weak against residential-proxy botnets, so never rely on them alone. Combine with fingerprinting and behavioural signals.

## TLS and protocol fingerprinting

**JA3/JA4 fingerprinting** classifies the TLS handshake and HTTP/2 behaviour of a client. Automated tools, scripted scrapers, and headless browsers often produce fingerprints distinct from mainstream browsers. This is a strong signal precisely because it is expensive for an attacker to forge without also emulating a full browser stack. Use fingerprints as a scoring input (challenge or throttle suspicious ones, allow known-good ones), not as a lone block decision, because legitimate privacy tools and unusual clients also look non-standard.

## Layer-7 DDoS and the login surface

Application floods target the endpoints that cannot be cached: login, search, and payment. Defences stack: rate limits, challenge responses, fingerprint scoring, and caching of any safely cacheable sub-response. A **cache-busting** flood that forces misses to origin is covered in [DDoS protection](https://adultinfra.com/docs/security/ddos-protection/); make sure your origin request rate is monitored, because it can rise while edge metrics look normal.

## Monitor versus block

Every new rule should start in **monitor mode**, logging what it would have done. Review the would-be blocks, measure the false-positive rate against real traffic, then move to enforcement. Keep a documented rollback path and a way to bypass a rule quickly when it misfires. For adult platforms the cost of a false positive is high: a blocked payment or login is lost revenue and a support ticket. Enforce deliberately, not all at once.

## Where AdultInfra fits

AdultInfra tunes WAF policy for the traffic adult platforms actually see: hostile-looking search terms, credential attacks on login, and payment endpoints that must stay reachable. Age verification, moderation, and lawful-content decisions remain the customer’s responsibility. Start with [Platform](https://adultinfra.com/platform/) or [contact us](https://adultinfra.com/contact/) to review a policy against your traffic.

**Need this configured for your platform?** [Get a test plan](https://adultinfra.com/contact/) and an engineer will map the resource, cache, and delivery design to your workload.

```json
{"@context":"https://schema.org","@graph":[{"@type":"TechArticle","headline":"Web application and API protection","description":"WAF policies for adult platforms: OWASP-style rules, custom rules, rate limiting, IP controls, TLS fingerprinting, L7 DDoS defence, and monitor versus block modes.","url":"https://adultinfra.com/docs/security/waf/","dateModified":"2026-09-13","keywords":"WAF for adult sites, web application firewall, OWASP rules, rate limiting, JA3 JA4 fingerprinting","author":{"@id":"https://adultinfra.com/#organization"},"publisher":{"@id":"https://adultinfra.com/#organization"},"inLanguage":"en"},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://adultinfra.com/"},{"@type":"ListItem","position":2,"name":"Documentation","item":"https://adultinfra.com/docs/"},{"@type":"ListItem","position":3,"name":"Web application and API protection","item":"https://adultinfra.com/docs/security/waf/"}]}]}
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://adultinfra.com/#organization","name":"AdultInfra","url":"https://adultinfra.com","logo":"https://adultinfra.com/favicon.svg","description":"Luxembourg-based specialist infrastructure for adult platforms.","slogan":"Already behind the adult internet.","areaServed":"Worldwide","knowsAbout":["Adult video CDN","Porn tube site infrastructure","Adult live-cam streaming","Creator subscription platforms","Byte-range video caching","Origin shielding","Player quality of experience","DDoS protection","GPU infrastructure","Adult-capable AI inference"],"location":{"@type":"Place","name":"Luxembourg","address":{"@type":"PostalAddress","addressCountry":"LU"}},"contactPoint":{"@type":"ContactPoint","contactType":"sales","url":"https://adultinfra.com/contact/"}},{"@type":"WebPage","@id":"https://adultinfra.com/docs/security/waf/#webpage","url":"https://adultinfra.com/docs/security/waf/","name":"Web application and API protection","description":"WAF policies for adult platforms: OWASP-style rules, custom rules, rate limiting, IP controls, TLS fingerprinting, L7 DDoS defence, and monitor versus block modes.","isPartOf":{"@id":"https://adultinfra.com/#website"},"about":{"@id":"https://adultinfra.com/#organization"},"primaryImageOfPage":{"@type":"ImageObject","url":"https://adultinfra.com/og-default.png"},"inLanguage":"en","mainEntity":{"@id":"https://adultinfra.com/docs/security/waf/#article"},"dateModified":"2026-09-13"},{"@type":"WebSite","@id":"https://adultinfra.com/#website","url":"https://adultinfra.com","name":"AdultInfra","description":"Luxembourg-based specialist infrastructure for adult platforms.","publisher":{"@id":"https://adultinfra.com/#organization"},"inLanguage":"en","potentialAction":{"@type":"ContactAction","target":"https://adultinfra.com/contact/"}}]}
```