Shield WAF

What Shield is

Shield is a managed Cloudflare-Worker-based WAF. Your customer-facing domain CNAMEs to customers.sectora.io. Cloudflare routes the request to the Shield Worker, which terminates TLS, runs every protection layer below, then proxies the request to your origin and processes the response on the way back.

Unlike traditional WAFs (Cloudflare default, AWS WAF, Imperva), Shield is tightly coupled to Sectora's scanner output — every confirmed vulnerability becomes a one-click virtual patch deployed globally in <30 seconds.

Architecture in 30 seconds

Browser
   │
   ├── DNS lookup: customer.com → CNAME → customers.sectora.io (DNS-only / gray cloud)
   │
   ▼
Cloudflare for SaaS (custom hostname, per-customer cert)
   │
   ▼
Shield Worker
   ├── Pre-flight (PLATFORM_REDIRECTS, internal __shield/* endpoints)
   ├── Config lookup (KV: which customer is this hostname?)
   ├── WAF layers (ordered, short-circuit on block):
   │     1. IP access policies (allow/deny lists)
   │     2. Rate limiting (per-IP, per-endpoint, per-method)
   │     3. Bot detection (heuristic + fingerprint)
   │     4. Managed rulesets (OWASP CRS, exploit signatures)
   │     5. Virtual patches (deployed from DAST/SAST findings)
   │     6. Schema enforcement (block requests that violate your OpenAPI)
   │     7. Anomaly scoring (behavioural model: is this a real user?)
   │     8. Custom rules (your team's)
   │     9. Leaked credential check (stuffing attempts)
   ▼
Origin (your Cloud Run / Vercel / Fly / on-prem server)

Protection layers

Each layer is independently configurable; they execute in the order above and short-circuit on a block decision. Brief descriptions below — each has its own deep-dive page.

Operating modes

Three modes for each protected site — pick per environment:

Fail-mode (origin down, what happens)

If your origin returns 5xx, Shield's default is fail-open— pass the request to origin anyway and let origin's 5xx propagate. This avoids Shield being blamed for outages it didn't cause.

Configurable per-site. fail-closedmode returns a Shield-served 503 when origin is down — useful when origin returning 5xx is itself a signal of attack (e.g. SQL panic from injection probe), and you'd rather not leak that.

Self-protection — sectora.io runs behind its own Shield

Sectora's own domains (sectora.io, www.sectora.io, staging.sectora.io) are on the PLATFORM_DOMAINS allowlist in the Worker — the management plane gets minimal WAF (no schema enforcement on /api/*, no rate limit on /_next/*) but full virtual-patch + IP access coverage.

Performance

Shield runs as a Cloudflare Worker — code is colocated with the user's nearest PoP. Typical added latency:

• p50: ~5ms — config lookup hits Worker memory cache.
• p95: ~15ms — config cache miss (KV read).
• p99: ~40ms — KV miss + cold-start. Improves after the first few hits.

Cloudflare bills only for CPU time consumed (typically <5ms per request); origin egress is unchanged. Shield's own cost is included in your Sectora plan — no separate Cloudflare bill.

Observability

Live tail

/__shield/live(auth'd) streams Worker decisions in real time — useful when rolling out a new rule. Same data feeds the Shield analytics dashboard.

Analytics

Per-site dashboard with request rate, block rate by layer, top blocked IPs/ASNs/paths, anomaly score distribution. Backed by a per-customer KV namespace; data retained for 30 days by default.

Audit log

Every config change (rule added, mode flipped, virtual patch deployed) appears in Settings → Audit Log with the actor, before+after, and timestamp.

Getting started

1. Verify your domain (Settings → Domains).
2. Open Shield → Add site. Pick the verified domain.
3. Set up DNS — CNAME your.domain → customers.sectora.io with DNS only (gray cloud).
4. Sectora auto-provisions a per-hostname TLS cert via Cloudflare for SaaS (~5–10 min).
5. Configure the layers you want enabled. Start in Log mode for a week.
6. Flip to Block after the baseline period.

Full walkthrough: Shield Setup.

Comparison vs Cloudflare native / AWS WAF / Imperva

What's next

• Setup — DNS, certs, first 24h after going live.
• Virtual Patching — the killer feature paired with DAST/SAST.
• Schema Enforcement — OpenAPI-driven blocking.
• Anomaly Scoring — behavioural model details.
• Shield API — automate everything.