FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

What does excluding static content from inspection gain in performance? ​

Short answer

A request treated as static does not enter the WAF inspection at all: no signature scanning is done, no Blacklist Protection check is done, no learning log or Event Logs record is created; the request is counted as Whitelisted in the WAF Inspection Distribution panel (Do Not WAF Static Contents). The gain is that the scan time and the learning log writing of these requests disappear entirely; on sites heavy with image, style and font files, the number of inspected requests decreases accordingly. A request is treated as static if four conditions are met together: the path ends with an extension in the list (such as .png, .jpg, .css, .woff2, .pdf; .js and .html are not in the list), the method is GET (HEAD is not included), there is no query and there is no body. This narrowing prevents an attack payload from being hidden in a path with a static extension through a query or a body. The setting is on the Whitelist & Blacklist card and is on by default. The gain is not shown as a separate number; it is monitored from the Whitelisted share in the WAF Inspection Distribution panel in Live Stats or Dashboard. For requests that are not static but whose inspection is not wanted, Whitelist Condition is used.

Static and Inspected Request ​

Request treated as staticInspected request
Signature and structural inspectionNoYes
Blacklist Protection checkNoYes
Learning Log and Event LogsNoDepending on the mode and the result
WAF Inspection DistributionWhitelistedClean, Blocked, Monitor, Teacher, Learning … (What do the Whitelisted, Clean, Blocked, Monitor, Teacher and Learning categories in WAF Inspection Distribution mean?)

Extensions treated as static: .txt .bmp .jpeg .jpg .png .gif .svg .svgz .webp .tif .tiff .css .ttf .woff .woff2 .pdf .ps .csv .doc .docx .ppt .pptx .xls .xlsx .mid .midi .swf .mp4 .flv .mov .wmv .avi .ogg .mkv .mpg. The extension matches as written, in lowercase.

  • Setting path: Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → the pencil icon of the Whitelist & Blacklist card in the Inspection & Blocking section → Do Not WAF Static Contents → Edit. It is also turned on with WEB-CLI. --syncWithDefaultFwRules is not a stored setting but a write trigger: only when true is written is the Any Paths rule rebuilt with its default definition; if it is not written in the command, the rule set is not touched. The false in the command states this explicitly (Sync with Default WAF Rules):
text
waf options update poolId <vService> --syncWithDefaultFwRules false --dontWafStaticContent true

Common Misconceptions ​

  • "Every request with a static extension is skipped." The method must be GET, and there must be no query and no body.
  • ".js and .html are also treated as static." These extensions are not in the list; they are inspected.
  • "HEAD requests are also skipped." The condition covers only GET.

How it is done in the documentation

Related questions