PowerSEC's Behavioral WAF is a pattern-inspection layer that runs on top of the core firewall. It is off by default and has three modes so you can turn it on without breaking your site. Turn it on under PowerSEC → Firewall → Behavioral WAF (Pattern Inspection).
Why three modes?
A web application firewall can block legitimate traffic ("false positives"). For example, an administrator who pastes a code snippet containing UNION SELECT into a post could see the save blocked as SQL injection. Starting in an observing mode lets you see what your own site's traffic matches before anything is blocked.
Mode 1: Learning (the default when you turn it on)
- Every request that matches a signature is logged in the WAF Block & Match Log.
- Nothing is blocked. The site behaves exactly as before.
We recommend about a week in Learning mode on a normal-traffic site, but this is only a recommendation.
Mode 2: Monitor
- Logs matches like Learning mode. Nothing is blocked.
- Use it for a quiet observation period once you have handled the false positives you found.
Mode 3: Block
- High-confidence rules and critical-severity rules block.
- On sensitive paths — the login page and wp-admin,
xmlrpc.phpandadmin-ajax.php— matches block whatever their confidence, except rules that are set to log only. - Elsewhere, medium-confidence rules only log.
- Low-confidence rules only log, unless you turn on Block low-confidence rules.
- Logged-in administrators are never blocked; their matches are logged.
You can switch to Block mode at any time; there is no waiting period.
What if a legitimate request is blocked?
Every match is recorded with the rule, the request path, the parameter and the address.
- Open PowerSEC → Firewall and the WAF Block & Match Log.
- Click Mark FP on the row.
- An exception is added for that URL path or parameter, and the request passes next time.
You can also switch back to Monitor or Learning mode at any time; the change takes effect immediately.
Comparison with the core firewall
The core firewall (IP blocking, rate limiting, optional geo-blocking, and SQL injection and XSS checks) is on by default even when the Behavioral WAF is off. The Behavioral WAF adds PowerSEC's wider signature library and the confidence model above — turn it on when you want stronger detection and are ready to review exceptions.