OVHcloud WAF
OVHcloud WAF
Protect your web applications and APIs against the most common attacks.
The alpha of OVHcloud WAF is only available to a limited number of customers. Access to the alpha is at the discretion of OVHcloud.
Region : Europe (Frances - Gravelines) - eu-west-gra
Price : Free during alpha
Why OWAF?
With OWAF, you take back control of the security of your web applications: you decide which rules apply, you keep ownership of your data, and you benefit from proven protection against the most common attacks — injections, malicious scripts, credential theft, bots, and application-layer denial of service.
OVHcloud WAF benefits
Comprehensive, clear, and fully managed protection for your internet-facing applications.
Out of the box protection
Block attacks instantly thanks to a rule library maintained by our security experts with zero configuration required.
Full visibility on your threats
A single console to see blocked traffic, identify attackers, and adjust your policies in just a few clicks.
Deployment in minutes
Guided onboarding, policies pre-tuned per application type. No dedicated security team required.
European sovereignty
Your requests, logs, and rules stay on OVHcloud infrastructure.
Predictable pricing
No per-request billing, no end-of-month surprises. You know up front what your security will cost.
No impact on performance
Your users won't notice a thing. Latency stays imperceptible, even under heavy load or during an active attack.
High Level Overview
For this alpha, the WAF sits inline between your clients and your backend. Inbound HTTP/HTTPS traffic enters on the data path; is inspected against the OWASP CRS rules, and either receives a 403 Forbidden or is proxied to your backend over HTTP/HTTPS. Configuration happens entirely on the WAF Console. Beta/GA will feature a closer integration with Public Cloud environment.
Use cases
OVHcloud WAF will be able to satisfy the following use cases when it reaches General Availability.
Filter malicious traffic
Automatically block SQL injections, XSS attacks, unauthorized access attempts, and exploits of known vulnerabilities before they reach your servers.
Take control of bot traffic
Tell legitimate bots (search engines, partners) apart from harmful ones (scrapers, vulnerability scanners) and apply the right policy to each.
Rate-limit by client
Protect your APIs and sensitive forms against abuse by capping the number of requests per IP, per user, or per endpoint.
Prevent account takeover
Detect and stop automated login attempts, credential stuffing, and brute-force attacks on your login pages.
Meet your compliance obligations
Demonstrate the deployment of a WAF to your PCI-DSS, ISO 27001, NIS2, or DORA auditors with a complete, exportable audit log.
Emergency virtual patching
A new CVE announced on a Friday evening? Push an OWAF rule to block exploitation, without waiting for the application patch.
How to join the OVHcloud WAF alpha
Take part in the program and help us shape OVHcloud Web Application Firewall.
- Join the alpha by completing the form.
- Receive your WAF and account access token.
- Make the domain name of your service point to WAF ingress IP.
- Start playing with WAF at https://labs.waf.ovh.net/.
For more details on WAF configuration, please refer to our WAF guide.
Key features
OWASP CRS 4.x rule engine
Full request inspection (headers, body, URI, cookies, query parameters) with anomaly-based scoring and 4 paranoia levels.
Three operating modes
Blocking (reject with 403), Detection (log only), and Disabled.
Custom rules
Up to 500 user-defined rules per instance, with targets, operators, transformations, severity, and per-rule actions.
Request header manipulation
Set, remove, move, or copy headers on the proxy path; built-in CORS handling and OPTIONS preflight passthrough.
Live stats dashboard
Real-time request counters, block/pass rates, active connections, and category breakdowns refreshing every 15 seconds.
TLS certificate management
Certificate creation and management fully handled by OVHcloud. Customer certificate support is on the roadmap.
Admin UI / API / Terraform
Configure every aspect of the WAF from the Admin UI today; a public API and Terraform provider are on the roadmap.
Public Cloud integration
Full integration of OVHcloud WAF into Public Cloud product line, allowing you to integrate easily with other Public Cloud products (instances, load balancers...).
FAQ
How do I join the alpha?
Submit the form on this page. OVHcloud reviews requests and provisions WAF configurations at its discretion; onboarding may take up to a few days.
What rules are included out of the box?
The OWASP Core Rule Set 4.x, with rules covering SQLi, XSS, RCE, LFI, SSTI, protocol violations, scanner detection, and more.
Can I edit or delete built-in rules?
No, but you can enable/disable them and override their action or paranoia level.
What is the difference between Blocking and Detection mode?
Detection logs matches but lets traffic through; Blocking rejects requests whose anomaly score meets or exceeds the threshold.
Does the WAF terminate TLS?
Yes, in alpha phase, the certificate is provided and managed by OVHcloud.
Is there a public API or Terraform provider?
Not in the alpha — configuration is via the Admin UI today. Both are on the roadmap before GA.
What protocols are supported?
HTTP/1.1 and HTTP/2. WebSocket traffic is proxied through but not deeply inspected in the alpha.
-
Alpha
-
Beta
-
General Availability