An overview of the rule engine, rate limiting, and security auditing — written for operators setting up or tuning a live install.
Start a 14-day evaluation to download the package and receive a trial code. Deploy the package to a non-production Lucee/CFML environment first, then use the guarded installer to create the required database tables and seed baseline rules.
Ignite WAF installs directly into your Lucee/CFML application. Once installed, it hooks into your application's request lifecycle so every inbound request is evaluated before it reaches your app code — no separate proxy or DNS change required.
Installation runs through a guarded installer that's disabled by default. Enabling it creates the core database tables and seeds the default rule set, so a fresh install starts with sensible baseline protection rather than an empty rule table.
Every request is evaluated against four rule types, in order. The first rule that denies a request stops evaluation there — later stages don't run.
Rules are scoped per site, so a rule you add for one tenant doesn't affect any other site on the same install.
Beyond the rule engine, Ignite WAF tracks request volume per IP in a rolling window. An IP that crosses the configured threshold is automatically jailed — its requests get denied until the window rolls forward or an operator releases it manually from the admin panel.
This catches request floods and brute-force attempts that wouldn't match a specific signature or path rule.
The CSP Security Audit fetches your site's live Content-Security-Policy header and checks it directive-by-directive — presence, default-src, script-src, unsafe-inline/unsafe-eval usage, object-src, frame-ancestors, and whether the policy is enforced or report-only, across 40+ individual checks.
Results are scored A–F. You can run an audit on demand from the admin panel, or schedule it to run automatically per site — scheduled runs can email the result to your team.
Quick Scan is a separate, broader check — it isn't a CSP-specific audit. It covers TLS configuration, cookie flags, CORS policy, clickjacking protection, and commonly exposed paths, and produces its own A–F grade on the same scale as the CSP audit.
Run CSP Audit and Quick Scan together for a fuller picture: CSP Audit goes deep on one header, Quick Scan covers the rest of your site's security posture.
One install can protect any number of sites. Each site has its own IP, path, signature, and user-agent rules, and its own request logs — nothing is shared across tenants by default.
Admin access is permission-scoped per user, per site. A super admin has full access everywhere; other operators can be granted specific permissions — viewing logs, editing rules, managing users, running audits — independently per site they're given access to.
Ignite WAF ships with adapters for Microsoft SQL Server, MySQL, and PostgreSQL behind a shared SQL-dialect layer. SQL Server is the primary, most-tested target; the MySQL and PostgreSQL adapters are there if that's what your environment already runs.