Last updated: · Prepared by DataKobi Engineering Team
WAF as a Service
A WAF (Web Application Firewall) is a security layer that inspects the HTTP/HTTPS traffic sent to your website and APIs and blocks SQL injection, XSS and similar application-layer attacks before they reach your application.
Every internet-facing web application becomes a target for automated scanners from the minute it goes live; honeypot measurements show that a new site sees its first attack attempt within minutes. A WAF stops a malicious request before it reaches your application, and often speeds up legitimate traffic through caching.
Our rule sets are based on OWASP CRS and are hand-tuned to your traffic; the first two weeks are spent learning in monitor mode, after which we switch to blocking mode. We do not block your legitimate customers with false positives. Bot management, rate limiting and L7 DDoS mitigation are included.
Key features
OWASP Top 10
An up-to-date rule set against injection, XSS, SSRF and the other critical categories.
Virtual patching
A protection rule within hours of a CVE announcement; it does not wait for a code change.
Bots and DDoS
Malicious bots are filtered out by fingerprinting; L7 floods are mitigated automatically.
Zero-downtime rollout
It learns in monitor mode first, then switches to blocking mode.
How does virtual patching work in practice?
When a critical CVE is announced, such as Log4Shell (CVE-2021-44228) or a vulnerability in an e-commerce platform, testing and applying the vendor patch takes organizations weeks on average, while attackers run mass scans within the first 72 hours. Virtual patching closes that window: a WAF rule that recognizes the exploit pattern of the vulnerability is added to the protection layer within hours of the CVE announcement, and it stops exploitation without touching the application code. For legacy applications that cannot be patched (the vendor has shut down, or there is no source code), virtual patching is also used as a permanent protection strategy, and auditors accept it as a compensating control.
How are APIs protected differently from classic websites?
Most modern traffic is no longer browser pages but API calls, and APIs have a different attack profile: instead of form-based XSS, broken object level authorization (BOLA), excessive data exposure and requests that fall outside the schema come to the fore (OWASP API Security Top 10). DataKobi WAF applies a positive security model to APIs: your OpenAPI/GraphQL schema is uploaded, and every request that does not conform to the schema, whether an unknown field, a wrong type or an unexpected method, is rejected by default. On top of this come per-endpoint rate limiting and token validation; bots scraping your mobile app's API are filtered out by fingerprinting.
Technical Specifications
- Rule set: OWASP CRS + DataKobi custom signatures
- TLS: Certificate management and TLS 1.3 termination included
- API protection: OpenAPI/GraphQL schema validation
- Reporting: Monthly breakdown of blocked attacks
- Hosting: In Türkiye; traffic does not leave the country
Frequently Asked Questions
Will a WAF slow down my site?
How are you different from global services such as Cloudflare?
What happens if there is a false positive?
A 30-minute discovery call with your architect
We will listen to your needs and outline the right architecture and a clear pricing framework in the same call. The first consultation is free.