What is a Page Type?

Short answer

A Page Type is a single WAF rule in the Page Types list of a host group. The rule is bound to a path pattern (exact or glob) and holds together the inspections to be applied to the requests coming to that path. Allowed Methods, Path Length, Path Depth and the OWASP scanning for the path are on the rule itself; the Check Fields sections (Query, Header, JSON, Xml, Form, Raw) inspect the other parts of the request. When a request arrives, WAF matches the path of the request with the list of the host group and inspects the request with the settings of the matching rule; a request that matches no rule is inspected with the Any Paths rule. Page types are produced from learning with Analysis & Learning and with Allow / Teach in Event Logs, manually with Add, and from a file with Import and Import (OpenAPI). The list of every host group is separate.

How Does It Work?

1. The request falls into a host group according to the Host header (Which host group does a request fall into; what if it matches none?).
2. The path of the request (without the query string, with the trailing / dropped) is matched with the page types of that group. If there is an exact rule that is exactly the same, that rule is applied; otherwise the glob rules that match the path are applied; if no rule matches, the request is inspected with the Any paths rule (If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?).
3. The path settings of the matching rule (method, length, depth, path signature scanning) and the Check fields inspections are applied; every violation is added to the attack score of the request.
4. If the host group is in Blocking mode and the total score reaches the blocking threshold, the request is blocked.

The Parts of a Page Type

Part	What it determines
Path	Which requests the rule is applied to; exact (/login) or glob (/api/v*/login) (What is the difference between an Exact Path and a glob path?)
Allowed Methods	The allowed HTTP methods (Can I allow only certain HTTP methods on a page (Allowed Methods)?)
Path Length · Path Depth	The length and depth limits of the path; only in glob rules and in Any paths (What are the Path Length and Path Depth constraints for?)
OWASP	The signature scanning of the Path section (What does turning OWASP scanning on or off at the Page Type level mean?)
Check Fields	The Query, Header, JSON, Xml, Form and Raw inspections; they are defined from the tabs of the detail panel after the rule is added (What is Check Fields; into which seven parts does the WAF split a request to inspect it?)

• The N page types number on the mode card also includes the Any paths rule (What is the Any Paths rule?).
• The source of the rules: Where do WAF rules come from (learning analysis, teaching from logs, manual definition)?
• Page types are applied only to the traffic of the host group they are in; the group setting (WAF Mode) determines whether the rules will block or not.

Common Misconceptions

• "A page type is an HTML page." A page type is a set of inspections bound to a path pattern; API endpoints are page types too.
• "A separate page type is needed for every URL." Variable parts are gathered into a single rule with glob (How do I merge several page types into one rule (Merge)?).
• "Page types are common across the whole vService." Every host group keeps its own list; the same path can exist in different groups with different settings.

How it is done in the documentation

• WAF Rules · Page Types
• WAF Rules · Page Types Listing Screen
• WAF Rules · Runtime: Rule Matching
• WAF · Terminology

Related questions

• What are the basic building blocks of TR7 WAF (WAF Mode, Virtual Host Group, Page Types, Any Paths, Check Fields, Signature)?
• What is Check Fields; into which seven parts does the WAF split a request to inspect it?
• What is a Virtual Host Group and what is it for?