Changelog
Changes we ship to the protection agent and dashboard, newest first. We say what changed, not how it works underneath.
Fixed an issue where the web application firewall could hold a POST request open when the client sent the request body in the same packet as the headers, a pattern used by several browsers and application frameworks, causing logins and form submissions to time out on affected sites. Inspection now completes immediately in that case.
The dashboard now raises an alert within seconds of a flood starting — including distributed floods coming from many sources at once — and opens an incident for it. A separate, higher threshold decides when a site is switched into aggressive Under Attack mode, so ordinary traffic spikes never trigger it.
The "filtered now" number on the Traffic and Security Events pages now shows the real-time rate while a flood is in progress, instead of a rolling average.
The status banner, the attack list and the 24-hour summary now always agree with each other, and a mitigated attack is still counted in the summary after it is over.
Sites behind Full HTTP Protection now receive HSTS, anti-clickjacking, MIME-sniffing and referrer/permissions headers on every response that doesn't already set its own — no configuration needed.
Version-revealing response headers such as Server are now stripped, so the software stack behind a protected site is not disclosed to visitors.
The protection proxy now offers only modern, forward-secret cipher suites on TLS 1.2 and enforces a server-side preference. Older, weaker suites can no longer be negotiated.
Requests to a protected site over plain HTTP are now redirected to HTTPS, and session cookies are marked Secure.
Sites that enable Full HTTP Protection are now covered on their real public port, with no port changes needed. Verified end to end from outside the network.
With Full HTTP Protection on, a request whose Host header doesn't match a site on the server is now rejected instead of passed through. Plain HTTP on port 80 is still on the list to cover.
A port declared with the Database purpose and no source-IP restriction is now blocked from the public internet, not just flagged in Verify. Restrict the port to specific IPs if you need remote access.