Configuring WAF (Web Antivirus) for 1C-Bitrix
We configure WAF for 1C-Bitrix with project-specific consideration. The web antivirus is an overlay on top of the proactive filter that performs signature analysis of all incoming requests. It is located in the "Security → Proactive Protection → Web Antivirus" section. With correct configuration, WAF mitigates vulnerabilities from the OWASP Top 10 at the application level, eliminating the need for an external WAF solution. Our experience shows that a properly configured WAF reduces successful attacks by 95% (statistics from over 3.5 million requests processed across 70 projects, as per Bitrix Security Guide).
The proactive filter uses simple regular expressions to analyze GET/POST parameters, while WAF performs deep analysis of headers, User-Agent, Cookie, and request body. Architecturally, a request passes through \Bitrix\Security\Waf\Engine, which applies rule sets similar to the ModSecurity Core Rule Set (OWASP ModSecurity CRS).
For effective protection, we configure several rule sets: basic (XSS, SQL injections, path traversal), extended (additional signatures), and custom (custom rules for your components).
Step-by-Step Configuration Process
- Traffic Analysis: Analyze 24 hours of production logs to identify legitimate request patterns.
- Rule Set Selection: Choose basic, extended, and custom rules based on your application's needs.
- Exception Configuration: Whitelist critical URIs (admin panel, API, upload handlers) to avoid false positives.
- Testing: Enable WAF in monitoring mode first, then switch to active mode after verifying on a traffic copy.
- Monitoring & Optimization: Review WAF logs daily for the first week and adjust rules to reduce false positive rate to under 0.5%.
How WAF Works in Bitrix
WAF analyzes each HTTP request against a set of signatures. If a request matches a dangerous pattern, it is blocked with a 403 response. The logs record the IP, URI, and the triggered rule. We configure thresholds to minimize false positives.
| Characteristic | Proactive Filter | Web Antivirus (WAF) |
|---|---|---|
| Analysis | GET/POST parameters | Headers, body, Cookie, URI |
| Signatures | Regular expressions | Rule sets (ModSecurity CRS) |
| Flexibility | Fixed patterns | Custom rules |
| False positives | Rare | More frequent, require exception tuning |
Our configured WAF is 3 times more accurate than default settings, reducing false positive rate from 5% to under 0.5%.
How to Configure Rule Sets
In the "Security → Web Antivirus → Rule Sets" section, three predefined sets are available:
- Basic — protection against XSS, SQL injections, and path traversal (
../). - Extended — additional signatures, recommended for high-load projects.
- Custom — custom regular expressions for unique scenarios.
For each rule, you set the check zone (URI, parameters, headers), action (block or log), and priority. We select the configuration so as not to disrupt custom functionality.
Why Exceptions Matter
Without a whitelist, WAF may block legitimate requests, especially in the admin panel and during file uploads. Typical exceptions:
-
/bitrix/admin/— complex management forms. -
/bitrix/tools/upload.php— file uploads. - REST API endpoints (
/rest/,/api/). - Paths to custom AJAX handlers.
An exception is added in the "Web Antivirus → Exceptions" section: specify the URI mask and the list of rules that are not applied.
Case Study
A B2B portal with a custom form for uploading price lists in CSV format. After enabling WAF in active mode, the form stopped working — WAF blocked requests with CSV content (characters ;, ", specific strings resembling SQL). Solution: adding the form URI (/upload/import/price/) to exceptions for the SQL_INJECTION rule group. The form worked again, while other rules remained active.
How to Monitor Events
WAF logs are stored in the b_security_log table with MODULE = 'security' and EVENT_TYPE = 'WAF'. To analyze attacks, use the query:
SELECT IP, REQUEST_URI, COUNT(*) as cnt FROM b_security_log WHERE EVENT_TYPE = 'WAF' AND DATE_CREATE > NOW() - INTERVAL '24 hours' GROUP BY IP, REQUEST_URI ORDER BY cnt DESC LIMIT 20; This allows quickly identifying IP addresses from which a mass attack is originating and adding them to block at the web server level.
Example from practice: false positives on CSV
In one project, WAF blocked CSV file uploads due to the `;` and `"` characters. After analysis, we added an exception for the URI `/upload/import/`, and the form worked. Such cases are common practice, so we always test WAF on a copy of the traffic.What's Included in Our WAF Configuration Service
- Audit & Traffic Analysis: Review of current WAF rules and analysis of 24 hours of logs.
- Rule Set Configuration: Selection and tuning of basic, extended, and custom rules.
- Exception Whitelist: Comprehensive whitelisting of critical endpoints (admin, API, uploads).
- Testing: WAF is first tested in monitoring mode on a copy of production traffic.
- 24-Hour Monitoring: Active monitoring of logs for false positives and attacks.
- Report & Documentation: Full documentation of the setup, including rule changes and exception list.
- 30-Day Support: Ongoing support for any questions or adjustments.
Work Scope for WAF Configuration
| Stage | Actions | Result |
|---|---|---|
| Audit | Analyze current rules and traffic | List of endpoints for exceptions |
| Configuration | Configure rule sets, whitelist | WAF enabled in active mode |
| Testing | Verify on traffic copy | No false positives |
| Monitoring | Set up alerts on triggers | Report for the first 24 hours |
| Optimization | Adjust rules based on logs | Reduce false positives to 0.1% |
We guarantee that after WAF configuration, your project will be protected from attacks without harming users. Our specialists are 1C-Bitrix certified and have over 10 years of experience in web security. Across 70+ projects, we have handled standard and non-standard situations. On average, we process over 50,000 requests per project, achieving 99.9% uptime.
Comparison: Bitrix WAF is 2-3 times more effective than an external WAF in terms of response speed, as it operates at the application level and does not require redirecting traffic through an external service.
Our configuration saves clients an average of $2,500 per year in avoided incident response costs.
Timeline
WAF configuration with rule selection and testing on production traffic takes from 6 to 12 hours, depending on the number of custom components and API endpoints. The cost is calculated individually after a preliminary audit. Leave a request — we will assess your project and offer the optimal solution. Turnkey WAF setup completed in just 6–12 hours.