A web application firewall you can tune without breaking real users

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

WebShield sits in front of your portals and applications at the TotalHeal edge, runs the OWASP Core Rule Set plus TotalHeal rules, learns before it blocks and reports attacks next to your endpoint and identity alerts. In our 8 Oct 2026 GoTestWAF run at paranoia level 1 every attack payload was blocked and no legitimate request was.

2The challenge

Public web applications and portals are attacked constantly: SQL injection, cross-site scripting, remote code execution, path traversal and exploits for known CVEs. Most organisations cannot patch every application quickly.

The TotalHeal approach. A filter in front of the application that blocks attacks, can be tuned without breaking real users, and reports attacks to the security team next to endpoint and identity alerts.

3Architecture

4How it works

1. VerifyProve the domain with a TXT record and point a CNAME at the edge.
2. DetectNew applications start in detect mode and learning mode.
3. TuneCreate exclusions per rule, path or field from real events, with suggestions.
4. BlockSwitch to block per application when false positives are gone.
5. CorrelateWAF events become XDR alerts with ATT&CK mapping and an attack map.

5Capabilities in detail

• Reverse proxy per applicationHost routing, weighted upstream pools and active health checks; unknown hosts are never proxied.
• TLS done for youAutomatic certificates or your own; TLS 1.2 minimum; HTTP/2 and HTTP/1.1.
• OWASP Core Rule SetOWASP CRS v4 with off, detect or block per app, paranoia level 1–4 and an anomaly threshold, plus the TotalHeal rule pack (XXE, SSTI, NoSQL, LDAP and more).
• Measured detection qualityIn our 8 Oct 2026 run of the open-source GoTestWAF tool at paranoia level 1, all attack payloads were blocked and no legitimate requests were blocked; the OWASP CRS regression suite passed 99.6 %.
• False-positive controlNew apps start in detect mode; learning mode; rule exclusions per rule, path and field, created from an event, with suggestions.
• Rate limits and blocklistsPer-IP and per-path rate limits, connection caps, body limits, and an IP blocklist from your threat intel with expiry and rollback.
• Virtual patches (Professional and Elite)A curated library of virtual patches for exploited CVEs, suggested from your vulnerability findings; a person approves.
• Signed policy with last-known-goodPolicy bundles are signed and rollback-protected; the edge falls back to the last known good policy.
• Country access controlAllow or block visitors by country for a whole application or for one path (for example only India on /admin), from an offline IP-location database. Detect mode reports what would be refused before you block.
• Alerts next to your other alertsWAF events become XDR alerts with ATT&CK mapping, an attack map and search. Every mode change and exclusion is audited.

6Security and data handling

• Unknown hosts never proxiedOnly verified domains are served by the edge.
• Signed policy, last known goodPolicy bundles are signed and rollback-protected; the edge keeps the last good policy.
• Every change auditedMode changes and exclusions are recorded with who and why.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• SaaS: a DNS TXT record and a CNAME for each protected domain; the origin reachable from the TotalHeal edge
• Self-hosted node: a Linux VM with systemd, outbound HTTPS, inbound 80/443

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.