Web Application Firewall (WAF)¶

Overview¶

StarkOne integrates ModSecurity (WAF) for HTTP-level attack detection and prevention. It ships with the OWASP Core Rule Set and an additional set of StarkOne custom signatures (starkone-rules.conf).

All WAF endpoints require superuser.

Status & Installation¶

# WAF status
GET /api/waf/status

# Install ModSecurity + OWASP CRS
POST /api/waf/install

# Uninstall
POST /api/waf/uninstall

Per-Site WAF Management¶

List Sites¶

GET /api/waf/sites

Returns all websites with their WAF status.

Enable / Disable WAF for a Site¶

POST /api/waf/sites/:id/enable
POST /api/waf/sites/:id/disable

Set WAF Mode¶

POST /api/waf/sites/:id/mode
{ "mode": "detection" }   # or "prevention"

Mode	Behaviour
`detection`	Log attacks but do not block
`prevention`	Block attacks (deny with 403)

WAF Events (Blocked Requests)¶

# Get events for a site
GET /api/waf/sites/:id/events?limit=100

# Parse raw log events
POST /api/waf/sites/:id/events/parse

# Clear events
DELETE /api/waf/sites/:id/events

Whitelist Rules¶

Add exceptions to prevent false positives:

POST /api/waf/sites/:id/whitelist
{
  "rule_id": "920350",
  "uri": "/wp-admin/",
  "comment": "WordPress admin needs this"
}

DELETE /api/waf/sites/:id/whitelist/:ruleId

Global Events¶

# Events across all sites
GET /api/waf/events

# Parse all events
POST /api/waf/events/parse

WAF Rules¶

# List all active rules (OWASP + StarkOne)
GET /api/waf/rules

# Get info about a specific rule
GET /api/waf/rules/:id

Global Settings¶

GET /api/waf/settings
POST /api/waf/settings
{
  "request_body_limit": "13107200",
  "audit_log": true
}

StarkOne Custom Signatures¶

StarkOne ships additional ModSecurity rules in /etc/modsecurity/starkone-rules.conf. These are automatically downloaded and updated when the panel updates.

Rule ID Ranges¶

Range	Category
`100001`-`100099`	WordPress protection
`100100`-`100199`	File upload protection
`100200`-`100299`	Scanner / bot detection
`100300`-`100399`	Generic attack patterns

Custom Rule Format¶

SecRule REQUEST_URI "@contains /wp-login.php" \
    "id:100001,\
    phase:1,\
    deny,\
    status:403,\
    log,\
    msg:'StarkOne WAF: WordPress login brute force attempt',\
    tag:'starkone-waf',\
    tag:'wordpress'"

See WAF Signatures for the full workflow for adding custom rules.