Protection Rules

Enable JA3/JA4 TLS Fingerprint Blocking

Loading module status…

nginx Variable for JA3 fingerprint Use $http_ssl_ja3_hash if nginx-ssl-fingerprint module is installed; use $http_x_ja3_fingerprint if set by upstream load balancer

	Fingerprint Hash	Library / Tool	Action

Enable Behavioral Bot Detection

WafX monitors nginx access logs every 20s. When a bot accesses a trigger URI (e.g. /api/login) without having loaded any required prerequisite pages first (e.g. / or /js/app.js), it is flagged as a bot.

Block duration (minutes)

Enable Credential Stuffing Protection

Monitors POST frequency to login URIs per IP. When a single IP exceeds the threshold within the time window, it is automatically blocked. Detects brute-force and credential stuffing attacks across all proxied apps.

Max attempts / IP

Window (minutes)

Block duration (min)

Monitored Login URIs (one per line)

Detection Events

Time	IP	Type	Rule	Detail	Action
No events

Apply

Writes /etc/nginx/conf.d/wafx_advbot.conf (geo + JA3 map blocks) and reloads nginx. All WafX-managed vhosts will have bot-block checks injected automatically.

Active Blocklist

No blocked IPs

How JA3 Works

JA3 is an MD5 hash of TLS ClientHello parameters (version, ciphers, extensions, elliptic curves). Each TLS library produces a unique hash:

Chrome 120 cd08e31...→ allowed

Python requests 3b5074b...→ blocked

Go net/http b12db4f...→ blocked

Requires ngx_http_ssl_fingerprint module for $ssl_ja3, or configure your upstream LB to set the X-JA3-Fingerprint header.

nginx Snippet Preview

# Enable and apply to generate the nginx conf.