TotalHealWebShieldWeb Application Firewall (WAF)
A web application firewall in front of your portals, tuned without breaking real users.
Trial: 30 days. You sign in to the TotalHeal console with a Sttiz account and activate WebShield WAF. No card.
Public web applications and portals are attacked constantly: SQL injection, cross-site scripting, remote code execution, path traversal and exploits for known CVEs. Most organisations cannot patch every application quickly.
A filter in front of the application that blocks attacks, can be tuned without breaking real users, and reports attacks to the security team next to endpoint and identity alerts.
WebShield WAF, feature by feature.
Reverse proxy per application
Host routing, weighted upstream pools and active health checks; unknown hosts are never proxied.
TLS done for you
Automatic certificates or your own; TLS 1.2 minimum; HTTP/2 and HTTP/1.1.
OWASP Core Rule Set
OWASP CRS v4 with off, detect or block per app, paranoia level 1–4 and an anomaly threshold, plus the TotalHeal rule pack (XXE, SSTI, NoSQL, LDAP and more).
Measured detection quality
In our 8 Oct 2026 run of the open-source GoTestWAF tool at paranoia level 1, all attack payloads were blocked and no legitimate requests were blocked; the OWASP CRS regression suite passed 99.6 %.
False-positive control
New apps start in detect mode; learning mode; rule exclusions per rule, path and field, created from an event, with suggestions.
Rate limits and blocklists
Per-IP and per-path rate limits, connection caps, body limits, and an IP blocklist from your threat intel with expiry and rollback.
Virtual patches (Professional and Elite)
A curated library of virtual patches for exploited CVEs, suggested from your vulnerability findings; a person approves.
Signed policy with last-known-good
Policy bundles are signed and rollback-protected; the edge falls back to the last known good policy.
Country access control
Allow or block visitors by country for a whole application or for one path (for example only India on /admin), from an offline IP-location database. Detect mode reports what would be refused before you block.
Alerts next to your other alerts
WAF events become XDR alerts with ATT&CK mapping, an attack map and search. Every mode change and exclusion is audited.
How WebShield WAF works.
WebShield sits in front of your portals and applications at the TotalHeal edge, runs the OWASP Core Rule Set plus TotalHeal rules, learns before it blocks and reports attacks next to your endpoint and identity alerts. In our 8 Oct 2026 GoTestWAF run at paranoia level 1 every attack payload was blocked and no legitimate request was.
- VerifyProve the domain with a TXT record and point a CNAME at the edge.
- DetectNew applications start in detect mode and learning mode.
- TuneCreate exclusions per rule, path or field from real events, with suggestions.
- BlockSwitch to block per application when false positives are gone.
- CorrelateWAF events become XDR alerts with ATT&CK mapping and an attack map.
Platforms and deployment
Platforms
| Platform | How it is covered |
|---|---|
| SaaS | Any web application over HTTP(S): verify the domain, point a CNAME at the TotalHeal edge |
| Self-hosted edge node | Linux with systemd, x86_64 or aarch64 (Professional and Elite) |
| Console | TotalHeal web console |
Deployment
| Profile | Status |
|---|---|
| SaaS (CNAME to the TotalHeal edge, India) | AvailableNo production point of presence with high availability yet. |
| Hybrid (self-hosted Linux edge node) | AvailableThe installer stays locked until the release key is published. |
| On-premises control plane | AvailableDelivered with our team from the on-premises kit. |
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. |
Essential, Professional or Elite.
Priced per protected application (fqdn) per year, with a monthly request allowance. Counted: applications configured; requests per month.
| Feature | EssentialUS$1,200per application per year | ProfessionalUS$3,600per application per year | EliteUS$9,600per application per year |
|---|---|---|---|
| Delivery from TotalHeal points of presence, OWASP CRS WAF, detect then block, paranoia levels, learning mode, exclusions, false-positive review | |||
| Rate limits, connection caps, IP blocklist, country allow and block per app and path, events, attack map, alerts in the incident queue | |||
| Self-hosted edge nodes in your data centre | |||
| Virtual patches from VulnSight findings and the CISA KEV catalogue, approved by you | |||
| Threat-actor and campaign intelligence on attackers |
List prices per application per year; minimum 1 application. Each tier includes everything in the tier before it. Volume, multi-product and partner pricing on request.
Government profile. Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks.
What you need
- SaaS: a DNS TXT record and a CNAME for each protected domain; the origin reachable from the TotalHeal edge
- Self-hosted node: a Linux VM with systemd, outbound HTTPS, inbound 80/443
Procurement documents for WebShield WAF
The datasheet is public. The full dossier is sent on request, so we can match it to your tender.
- Datasheet. What the product does, platforms, deployment profiles, tiers and honest limits.
- Compliance matrix. Each requirement marked comply, partial or no, with an evidence reference — CERT-In directions, DPDP, ISO 27001 controls touched, accessibility of the console, data residency.
- Bill of materials. SKUs per sizing, the unit and quantity formula, customer-side components and services.
- Architecture and hardening. How the product is deployed and the hardening guidance for each component.
- SLA. Support tiers, response targets the team can meet, update cadence and end-of-life policy.
- OEM authorisation letter. A MAF template for resellers and system integrators, with product names exactly as on the SKU.
Works well with
Part of TotalHeal Edge Defense suite and of Complete — each product is still licensed on its own.
TotalHealTrafficShield
Bot management & L7 DDoS
Keep bots, credential stuffing and application-layer (Layer 7) floods off your sites.
TotalHealVulnSight
Vulnerability Management
Know which installed software carries a known, exploited vulnerability — without a scanner appliance.
TotalHealDNSGuard
DNS Firewall & Security
Stop malware, phishing and DNS tunnelling at the lookup — for every device, on site or on the road.
TotalHealZeroGate
Zero Trust Network Access (ZTNA)
Access to named apps and servers only, re-checked continuously — not the whole subnet.
Get a quote for WebShield WAF.
Tell us how many protected application (fqdn)s you need and how you want to deploy. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.