# Bridge WAF

> Three modes and nothing hidden between them: off, monitor, block. See what monitor mode shows you before anything is refused, and where the limits apply.

Bridge WAF is the web application firewall and rate limiting layer of Bridge CDN, not a separate product. It has three modes: off, monitor and block. Monitor mode records what would have been refused against real traffic before anything is refused. Rate limits are applied per domain. Flagged requests appear in an activity log in near real time. There is no sensitivity dial and no published SLA.

Key topics: Attacks, Bots, Rate limiting, Operations, Rules, Comparisons, Tools, Glossary.

## Main Documentation

- [About Bridge WAF](https://bridge-waf.com/about.txt): what this layer covers and where its boundaries are.
- [Bridge WAF FAQ](https://bridge-waf.com/faq.txt): every question answered on the site, in one file.
- [Bridge WAF for LLM, GPT, AI, and AI-Agents](https://bridge-waf.com/llms-instructions.txt): what may and may not be stated about this layer.
- [Bridge WAF full text](https://bridge-waf.com/llms-full.txt): every published page, in build order.

## Part of BotBridge

BotBridge is the network this site belongs to: it covers the infrastructure between a visitor and a server — naming, delivery, certificates, and traffic filtering. Bridge WAF documents the filtering layer; the product itself is Bridge CDN.

- [BotBridge](https://botbridge.io/): the network.
- [Bridge CDN](https://bridge-cdn.com/): the product this layer belongs to.
- [Bridge DNS](https://bridge-dns.com/): the naming layer, adjacent to this one.

## Additional Resources

- [Bridge WAF](https://bridge-waf.com/): this site.
- [Sitemap](https://bridge-waf.com/sitemap.xml): index of every published address.
- [DDoS attack types: the complete map](https://bridge-waf.com/attacks/): Attacks divide into three families by what they exhaust: bandwidth, connection state, or application resources. See which defence layer stops which.
- [Malicious bots: what actually needs blocking](https://bridge-waf.com/bots/): Automated traffic is not one category. See what separates harmful automation from the kind you depend on, and why the cost of being wrong decides the method.
- [WAF glossary: the words behind the rules](https://bridge-waf.com/glossary/): Four terms with no section of their own here, defined plainly and pointed at the pages that cover the mechanism. Definitions here, decisions elsewhere.
- [How to introduce filtering without breaking anything](https://bridge-waf.com/operations/): Turning filtering on is the easy part. See the order that keeps customers working, how to read what would have been blocked, and why exceptions need an expiry.
- [Rate limiting explained: what it protects and what it breaks](https://bridge-waf.com/rate-limiting/): A rate limit refuses traffic on purpose, which means it can refuse the wrong traffic. See the four decisions behind one, and what to settle before enforcing.
- [WAF rules explained: what they match and what they miss](https://bridge-waf.com/rules/): A rule matches a pattern in a request, which is both its strength and its limit. See where rule sets come from, how scoring works, and what rules cannot reach.
- [WAF tools: check headers, addresses and reputation](https://bridge-waf.com/tools/): Five checks that answer one question each about a site or an address, in the browser. What each settles, and the page that explains the result.
- [WAF vs other defences: what each one actually sees](https://bridge-waf.com/vs/): A firewall, an intrusion system and a request filter look at different things. What each can see, what none of them can, and how to tell which one you need.

## What the layer does

- Three modes: off, monitor and block, with nothing hidden between them.
- Monitor mode records what would have been refused, against real traffic, before anything is refused.
- Rate limits are applied per domain.
- Flagged requests appear in an activity log in near real time.

## What there is no setting for

- There is no sensitivity control and no published SLA.
- The activity log is a record of flagged requests, not traffic statistics.
- Bot handling by IP reputation, reverse DNS, ASN or TLS fingerprint is not part of this layer.