OVHcloud WAF
OVHcloud WAF
Protect your web applications and APIs against the most common attacks, without handing your traffic to a third party.
The alpha of OVHcloud WAF is only available to a limited number of customers. Access to the alpha is at the discretion of OVHcloud.
Why OWAF ?
With OWAF, you take back control of the security of your web applications: you decide which rules apply, you keep ownership of your data, and you benefit from proven protection against the most common attacks — injections, malicious scripts, credential theft, bots, and application-layer denial of service.
OVHcloud WAF benefits
Comprehensive, clear, and fully managed protection for your internet-facing applications.
Out of the box protection
Block attacks instantly thanks to a rule library maintained by our security experts with zero configuration required.
Full visibility on your threats
A single console to see blocked traffic, identify attackers, and adjust your policies in just a few clicks.
Deployment in minutes
Guided onboarding, policies pre-tuned per application type. No dedicated security team required.
European sovereignty
Your requests, logs, and rules stay on OVHcloud infrastructure. GDPR, NIS2, and DORA compliance guaranteed.
Predictable pricing
No per-request billing, no end-of-month surprises. You know up front what your security will cost.
No impact on performance
Your users won't notice a thing. Latency stays imperceptible, even under heavy load or during an active attack.
Basic setup overview
The WAF sits inline between your clients and your backend. Inbound HTTP/HTTPS traffic enters on the data path; is inspected against the OWASP CRS rules, and either receives a 403 Forbidden or is proxied to your backend over HTTP/HTTPS. Configuration happens entirely on a separate Admin UI authenticated with a Bearer token.
Use cases
Filter malicious traffic
Automatically blockSnjections, XSS attacks, unauthorized access attempts, and exploits of known vulnerabilities before they reach your servers.
Take control of bot traffic
Tell legitimate bots (search engines, partners) apart from harmful ones (scrapers, vulnerability scanners) and apply the right policy to each.
Rate-limit by client
Protect your APIs and sensitive forms against abuse by capping the number of requests per IP, per user, or per endpoint.
Prevent account takeover
Detect and stop automated login attempts, credential stuffing, and brute-force attacks on your login pages.
Meet your compliance obligations
Demonstrate the deployment of a WAF to your PCI-DSS, ISO 27001, NIS2, or DORA auditors with a complete, exportable audit log.
Emergency virtual patching
A new CVE announced on a Friday evening? Push an OWAF rule to block exploitation, without waiting for the application patch.
How to join the OVHcloud WAF alpha
Take part in the program and help us shape OVHcloud Web Application Firewall.
- Join the alpha by completing the form - provide origin URL and DNS name of your service - an OVHcloud team member will contact you.
- Receive your instance — OVHcloud provisions a WAF configuration and shares a Bearer token.
- Sign in to the Admin UI with Bearer token at : https://labs.waf.ovh.net/
- Make the DNS name of your service point to WAF ingress IP.
- Configure your rules : start in Detection mode at Paranoia Level 1.
- Send test traffic to your service DNS name and review what the rules match in the Stats dashboard.
- Switch to Blocking mode once you are confident, tune custom rules, and share feedback.
For more details on WAF configuration, please refer to our documentation on docs.ovhcloud.com (coming soon).
Key features
OWASP CRS 4.x rule engine
Full request inspection (headers, body, URI, cookies, query parameters) with anomaly-based scoring and 4 paranoia levels.
Three operating modes
Blocking (reject with 403), Detection (log only), and Disabled.
Custom rules (coming soon)
Up to 500 user-defined rules per instance, with targets, operators, transformations, severity, and per-rule actions.
Request header manipulation (coming soon)
Set, remove, move, or copy headers on the proxy path; built-in CORS handling and OPTIONS preflight passthrough.
Live stats dashboard
Real-time request counters, block/pass rates, active connections, and category breakdowns refreshing every 15 seconds.
TLS certificate management
Certificate creation and management fully handled by OVHcloud. Customer certificate support is on the roadmap.
Admin UI / API / Terraform
Configure every aspect of the WAF from the Admin UI today; a public API and Terraform provider are on the roadmap.
Public Cloud integration (coming soon)
Full integation of OVHcloud WAF into Public Cloud product line, allowing you to integrate easily with other Public Cloud products (instances, load balancers...).
FAQ
How do I join the alpha?
Submit the form on this page. OVHcloud reviews requests and provisions WAF configurations at its discretion; onboarding may take up to a few days.
What rules are included out of the box?
The OWASP Core Rule Set 4.x, with rules covering SQLi, XSS, RCE, LFI, SSTI, protocol violations, scanner detection, and more.
Can I edit or delete built-in rules?
No, but you can enable/disable them and override their action or paranoia level.
What is the difference between Blocking and Detection mode? the alpha?
Detection logs matches but lets traffic through; Blocking rejects requests whose anomaly score meets or exceeds the threshold.
Does the WAF terminate TLS?
Yes, in alpha phase, the certificate is provided and managed by OVHcloud.
Is there a public API or Terraform provider?
Not in the alpha — configuration is via the Admin UI today. Both are on the roadmap before GA.
What protocols are supported?
HTTP/1.1 and HTTP/2. WebSocket traffic is proxied through but not deeply inspected in the alpha.