Minimum score required to trigger a blocking action
Request Body Limit (MB)
Maximum allowed request body size in megabytes
Security & Monitoring
Audit Logging
Enable detailed audit logs for all WAF decisions
Real-time Alerts
Send notifications for critical security events
GeoIP Blocking
Block requests from high-risk geographic regions
Real Client IP NAT / PROXY
Extract the true client IP when WafX sits behind a proxy, CDN, or load balancer
⚠ nginx_http_realip_module not detected
How it works: When traffic passes through an upstream proxy (Cloudflare, AWS ALB, nginx load balancer, corporate gateway…), the TCP connection IP seen by nginx is the proxy's IP — not the real visitor. The proxy sets the true IP in a request header (X-Forwarded-For, CF-Connecting-IP, etc.). Enabling this uses nginx's ngx_http_realip_module to replace $remote_addr with the value from that header — so rate limiting, IP reputation, and logs all see the real visitor IP.
Enable Real IP Extraction
Write set_real_ip_from / real_ip_header directives to nginx conf.d
Real IP Header
The request header that carries the true client IP
Recursive IP Resolution
real_ip_recursive on — skip all trusted-proxy IPs in the chain to find the leftmost untrusted IP
Trusted Proxy IPs / CIDRs
One IP or CIDR per line. These are the upstream proxies whose header is trusted. ⚠ Cloudflare users: Traffic arrives from Cloudflare's IPs — all Cloudflare ranges must be listed here, and header must be set to CF-Connecting-IP.
Without this, nginx sees a Cloudflare IP as $remote_addr — so IP whitelist / deny rules and rate-limiting compare against the wrong IP.
See cloudflare.com/ips for the official ranges.