WAF and web security terms, in plain English.

A WAF setting where requests that score as attacks are refused instead of only being recorded.

In DBshieldX, block mode is switched on per route, one route at a time, once that route has run 7 days in monitor mode with its review queue settled. You get an alert on the first block.

See also: Monitor mode, Policy version

Trying usernames and passwords leaked from other sites against your login page.

Because many people reuse passwords, attackers replay leaked pairs at scale. Two-factor sign-in and rate limits help. DBshieldX treats repeated sign-in failures from a client over time as a behaviour rule.

An attack that gets a site to deliver attacker-controlled script to other visitors’ browsers.

XSS lets an attacker act in a victim’s browser as if they were the site. The main defences are output encoding and a strict Content-Security-Policy; a WAF adds detection of script, event-handler and URL vectors in requests.

An open-source tool that bans abusive IP addresses and shares blocklists between its users.

DBshieldX can send repeat high-risk clients to CrowdSec for a ban of 4 hours, then 24 hours, then 7 days, shared across all your servers. In the 7 days to 7 November 2026, only 11 of the 159 clients DBshieldX would have blocked on our sites were already on CrowdSec blocklists.

A narrow exception that stops one rule from firing on one field of one route.

Rather than turning a noisy rule off everywhere, an exclusion tells the firewall that a particular field on a particular route legitimately carries content the rule would otherwise flag. Everywhere else, the rule still applies.

See also: Review queue, False positive

A design where, if the security check is slow or unavailable, traffic is allowed through rather than stopped.

A fail-open firewall keeps your site up if the firewall itself has a problem; the error is logged. The trade-off is that requests are not inspected during the fault. DBshieldX fails open.

See also: Reverse proxy

A legitimate request that a security rule flags or blocks as an attack.

False positives are the main reason teams hesitate to switch a WAF to blocking. DBshieldX counts any block that you later mark as expected traffic as a false positive, per route, so you can see whether blocking is safe to keep on.

See also: Review queue, Exclusion

A tool that sends large numbers of varied, malformed inputs to find ones an application mishandles.

Fuzzers are used both by testers and attackers. Their traffic is noisy and varied, which makes it easy to tell apart from real visitors over time.

See also: Scanner

A WAF setting where every request is inspected and scored, and what would have been blocked is recorded, but nothing is actually blocked.

Also called detection-only or log-only mode. Monitor mode shows what a firewall would stop on your real traffic without affecting any visitor, so you can find expected traffic that looks suspicious before you switch blocking on. In DBshieldX every route starts in monitor mode.

See also: Block mode, Review queue, False positive

The time within which 95% of requests complete: only 1 in 20 takes longer.

Percentiles describe the slow end of the range better than an average. DBshieldX added 3.2 ms at p95 on our live traffic in October 2026.

An attack that tries to read files outside the folder an application meant to serve.

Path traversal uses relative path segments, often encoded or doubled to avoid simple filters, to reach files such as configuration or system files. DBshieldX decodes path encodings before it scores.

A saved, numbered state of a site’s WAF settings that can be reactivated later.

In DBshieldX every policy change creates a new version. Activating an earlier version rolls back to it, and every proxy picks up the change in under 7 seconds with no restart.

See also: Block mode

The structure of a SQL query with its values removed.

An application sends the same few query shapes over and over with different values. An injection changes the shape. DBshieldX learns each app’s shapes from normal use and flags a query with a shape it has never seen; it never stores the values.

See also: SQL injection

A server that receives requests on behalf of an application and passes them on to it.

nginx is the most common example. DBshieldX adds a small proxy behind the nginx you already run, rather than replacing it, so TLS and caching stay as they are.

See also: Web application firewall (WAF)

The list of grouped findings that a person marks as an attack or as expected traffic.

In DBshieldX, findings from monitor mode are grouped by rule, field and route. Marking a group as expected creates a precise exclusion; marking it as an attack confirms that blocking would be right. A settled queue is one of the conditions for a route to block.

See also: Exclusion, Monitor mode

A program that automatically requests common paths and tests for known weaknesses across many sites.

Scanners ask every site the same questions, such as whether a .env file or a WordPress login page exists, whatever the site runs. On our own sites, every would-block client we profiled in the 7 days to 7 November 2026 was a scanner or fuzzer.

See also: Fuzzer

An attack that makes a server send requests to places the attacker can’t reach directly.

Typical targets are internal services and cloud metadata endpoints, which can hand out credentials. DBshieldX flags requests that point an application at internal or cloud-metadata addresses.

An attack where input from a request changes the structure of a database query.

SQL injection happens when an application builds queries by joining user input into SQL text. The fix in code is parameterised queries. A WAF adds detection at the request; DBshieldX also checks the queries themselves at the database layer.

See also: Query shape (query fingerprint)

A filter in front of a web application that inspects HTTP requests and stops the ones that look like attacks.

A web application firewall sits between visitors and your application and inspects each HTTP request: the path, query string, form fields, JSON body and headers. It scores each request against rules and can log it, block it, or let it through. A WAF works at the application layer; it is not a network firewall and not a volumetric DDoS service.

See also: Reverse proxy, Monitor mode, Block mode