Can I change the blocking page?

Short answer

Yes. The blocking response is changed from the window opened with the pencil icon of the Blocking Page card in the Inspection & Blocking section on the WAF Management tab. If Manual content is selected in the Blocking Page Source field, the content type and the content are written directly into the window; if Content profile is selected, a profile under Load Balancer → Profiles → Content Pages or the built-in WAF Blocking Page (English/Turkish) profile is used. In the same window, ready-made templates are applied with a single click and different pages depending on a condition are defined. The status code is selected separately in the Blocking Status Code field. The change is saved with Edit and is applied without a separate deployment step; in WEB-CLI, the same fields are written with waf options update.

Problem: The Default Blocking Page Does Not Suit the Organization

The blocked user is to be shown a response that carries the organization's identity, in the right language and in the right format (HTML for the browser, JSON for the API). When WAF is turned on, the response is TR7's built-in English blocking page (What does a blocked user see?).

Solution: Three Methods

Methods 1 and 2 are two options of the same field; one of them is selected. Ready-made templates set up one of these two options with a single click (What are the ready-made blocking page templates (Turkish, English, JSON)?).

Your situation	Suitable method
I will write the content directly for this vService	Method 1: Manual content
I will use the same page on multiple vServices or select the built-in page	Method 2: Content profile
I want to do it with a script or the command line	Method 3: WEB-CLI

Method 1: Manual Content

• How it works The content type and the content are written directly into the WAF setting.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Blocking Page card → pencil icon
• Requirement WAF-enabled HTTP vService
• Scope Across the vService; common to all host groups

Step-by-Step Configuration

1

Adım 1 Open the Blocking page window

In Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Blocking page card in the Inspection & Blocking section is clicked (Blocking Page Edit screen).

2

Adım 2 Select the source

Manual Content is selected in the Blocking Page Source field; the Blocking Page Content Type and Blocking Page fields appear in the window.

3

Adım 3 Select the content type

The type is selected from the Blocking Page Content Type list: text/html, text/plain, text/css, application/json, application/xml or application/x-ns-proxy-autoconfig. charset=utf-8 is added to the response automatically.

4

Adım 4 Write the content

The content is written into the Blocking Page field; the field cannot be left empty. With the text/html type, there is an HTML source / Visual editor switch next to the bottom left corner of the field: a complete HTML document opens in the visual editor, and other content opens as HTML source. In the visual editor, a variable is added with the Add TR7 variable (fx) button on the toolbar; in the HTML source, the variable is written directly (e.g. %UID for the Request ID, %SRCIP for the client IP) (Which Smart Variables can I use on the blocking page (%UID, %SRCIP, %WAFSCORE, %WAFINFO …); is it safe to show attack details?).

5

Adım 5 Check the status code

The code in the Blocking Status Code field is checked; the default is 418 (Why is the 418 status code returned by default on a block; can I change it?).

6

Adım 6 Save

Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1Blocking page cardTR7 side

The sentence of the Blocking page card on the WAF Management tab is examined.

ExpectedA blocked client gets the inline content (text/html) with status 418

2Blocked requestClient side

A request that triggers a signature is sent to the host group in Blocking mode.

Command: curl -i "https://www.example.com/?q=%3Cscript%3Ealert(1)%3C/script%3E"

ExpectedThe selected status code and the written content

Method 2: Content Profile

• How it works The content comes from a Content Pages profile; the content type is read from the profile. When the profile is edited, the response changes as well.
• Where it is openedBlocking Page card → pencil icon → Blocking Page Source = Content Profile
• Requirement The Content Pages profile to be used (the built-in profiles are ready; adding a new profile requires modify permission in the Load Balancer area)
• Scope Across the vService; the same profile can also be used on other vServices

Step-by-Step Configuration

1

Adım 1 Open the Content Pages list (if needed)

If the built-in WAF Blocking Page (English) or WAF Blocking Page (Turkish) is to be used, steps 1–3 are skipped. For a custom page, Add is clicked on the Load Balancer → Profiles → Content Pages screen (how to add).

2

Adım 2 Fill in the profile (if needed)

The Content Page Name, Content Type and Content fields are filled in; it is possible to start by selecting and editing one of the built-in ready-made pages at the top of the form (What is the Content Pages profile; how do I prepare my own HTML page?).

3

Adım 3 Save the profile (if needed)

Add is clicked.

4

Adım 4 Open the Blocking page window

In Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon of the Blocking Page card is clicked.

5

Adım 5 Select the profile

Blocking Page Source = Content Profile is selected; the profile is selected from the Blocking Page Profile list. The content is previewed with the info icon next to the selected profile; a new profile can also be created from the list.

6

Adım 6 Save

Edit is clicked; the change is applied without a separate deployment step and, in a cluster setup, is sent to the peer device with the default auto-sync.

Verification

1Blocking page cardTR7 side

The sentence of the Blocking page card on the WAF Management tab is examined.

ExpectedA blocked client gets the <profile-name> page with status 418

On a blocked request, the content and the content type of the profile are returned.

Method 3: WEB-CLI

• How it works The blocking page fields are written with WEB-CLI.
• Where it is opened WEB-CLI → waf options update
• Requirement WEB-CLI access
• Profile ID The built-in profiles carry the builtin_waf_block_en and builtin_waf_block_tr IDs

Step-by-Step Configuration

1

Adım 1 Write the profile source

To select the built-in Turkish page (blocking page fields):

waf options update poolId <vService> --syncWithDefaultFwRules false --blockingContentSource profile --blockingContentProfile builtin_waf_block_tr

Verification

1Setting recordTR7 side

The WAF settings of the vService are displayed.

Command: waf options show poolId <vService>

ExpectedblockingContentSource profile · blockingContentProfile builtin_waf_block_tr

Common Mistakes

• Saving without checking the selection the window opens with. If the Blocking page window has never been saved after WAF was turned on, the window opens with Content Profile and WAF Blocking Page (English) selected; even if only the status code is changed and Edit is clicked, the default page switches to this profile. If the Turkish page is wanted, WAF Blocking Page (Turkish) is selected.
• Thinking that the status code changes with the template. Templates do not change the default status code; the code is selected from the Blocking Status Code field (Why is the 418 status code returned by default on a block; can I change it?).
• Deleting the Content Pages profile in use. If the selected profile is deleted, the body of the blocking response becomes the WAF BLOCKED text; before the profile is deleted, another source is selected in the Blocking page window.
• Showing attack details to everyone. %WAFINFO carries the signature and score details to the client (Which Smart Variables can I use on the blocking page (%UID, %SRCIP, %WAFSCORE, %WAFINFO …); is it safe to show attack details?).

How it is done in the documentation

• Blocking Page · Blocking Page Source
• Blocking Page · The Blocking Page Edit Screen
• Content Pages · How to Add?
• WEB-CLI waf options · The Blocking Page

Related questions

• What is the Content Pages profile; how do I prepare my own HTML page?
• What are the ready-made blocking page templates (Turkish, English, JSON)?
• Can I define different blocking pages depending on conditions (Conditional Blocking Pages)?