---
title: "OWASP ruleset"
date: "2026-04-30T07:46:44+00:00"
summary: "Protect your app with Acquia Edge's OWASP WAF ruleset. Learn how to manage rule groups and guard against top web threats."
image:
type: "page"
url: "/acquia-cloud-platform/add-ons/edge-standard/owasp-ruleset-0"
id: "d1e3b20a-eaa5-4f20-b4fe-a7d8a954cdfb"
---

Acquia Edge Standard includes preset Web Application Firewall (WAF) rulesets designed to mitigate common threats such as the Open Web Application Security Project (OWASP) Top 10. The OWASP ruleset is enabled by default and provides a foundational layer of security against common web-based vulnerabilities.

You can review and deactivate specific OWASP rule groups if needed. However, deactivating protections is not recommended because it can leave your application vulnerable.

### Open the OWASP ruleset

1.  In the _Edge console_, navigate to _Security_.
2.  Select _Rule configuration_.
3.  Select _WAF Rulesets_.
4.  Select the _OWASP ruleset tab_.

The page displays a summary of the ruleset, the number of active rules, and a table of OWASP rule groups.

### OWASP protections included

The OWASP ruleset includes rule groups for the following types of threats:

*   SQL Injection (SQL-INJECTION-ANOMALY): Detects SQL injection attempts and suspicious database queries intended to steal or manipulate data.
*   Cross-Site Scripting (XSS-ANOMALY): Identifies cross-site scripting (XSS) attempts that inject scripts into separate browser sessions.
*   Remote File Inclusion (RFI-ANOMALY): Prevents attempts to force the application to include and execute external malicious files.
*   Local File Inclusion (LFI-ANOMALY): Blocks attempts to access restricted files stored locally.
*   Command Injection (CMD-INJECTION-ANOMALY): Detects attempts to execute unauthorized system commands.
*   Protocol Attack (PROTOCOL-ANOMALY): Detects protocol-level attack patterns and malformed requests.
*   Web Application Attack (WAT-ANOMALY): Detects general web application attack patterns and suspicious traffic behavior.

The OWASP ruleset table lists each OWASP rule group and includes:

*   _Rule name_: The OWASP rule group.
*   _Description_: What the rule group is designed to detect or block.
*   _Toggle_: Enables or deactivates the rule group.
*   _Rule documentation_: Opens provider documentation for additional technical detail.

### Enable or deactivate OWASP rule groups

By default, all OWASP rule groups are enabled. You can deactivate individual rule groups if you have a confirmed false positive or a specific operational requirement.

Important

Deactivating OWASP protections reduces your security coverage and can leave your application vulnerable. Only deactivate a rule group after you confirm it is blocking legitimate traffic and you understand the security impact.

### Verify OWASP rule activity

Note

The Security Metrics dashboard reflects activity from Custom WAF rules only. Requests blocked by OWASP rule groups are not currently visible in the customer-facing analytics dashboard. This is a known platform limitation.

To verify that an OWASP rule group change has the intended effect, contact [Acquia Support](/service-offerings/support "Support"). The support team can review server-side logs to confirm rule activity.

For information about traffic blocked by Custom WAF rules, visit [Security Metrics](/acquia-cloud-platform/add-ons/edge-standard/security-metrics-dashboard "Security Metrics Dashboard").