Security

The WAF only does its job if the origin cannot be reached another way. This page gathers the security decisions that stay on your side and what NNumbers takes on.

Origin protection

The WAF does not prevent a direct attack on the origin. If the server hostname still resolves publicly and accepts connections from anywhere, an attacker talks to it without passing inspection — and the event never appears in the Console.

Measure	Effect
Restrict the origin to the NNumbers egress addresses	Only edge traffic reaches the server
Do not publish the origin address in public DNS	Reduces direct discovery
Keep the origin firewall closed to everything else	Closes the bypass
Do not use the same hostname as the origin of another protected domain	Avoids loops and registration confusion

The egress address list is shown in the Console. It is the source for your origin firewall rule, and it is not a single fixed address: apply the whole list and review it when it changes.

DNS and HTTPS

Record	Role	Care
_nnwaf-challenge.<hostname> TXT	Continuous proof of ownership	Keep it as long as the domain exists; 7 days missing degrades the domain
_acme-challenge.<hostname> CNAME	Authorizes certificate issuance before the traffic switch	Create it before routing to avoid an error window
<hostname> CNAME, or A/AAAA on the apex	Brings traffic to the edge	Switch only after the certificate is ready

The certificate is issued and renewed by NNumbers, through Let's Encrypt. TLS verification to the origin is always performed and cannot be disabled: an origin with an expired, self-signed or mismatched certificate answers 502, even if the application is up.

Data and retention

Data	Handling
Events	Retained for 30 days
Aggregated metrics	Retained for 12 months
Authorization, cookies, bodies, query strings, tokens	Not stored
Application response content	Not inspected and not stored
Administrative changes	Recorded in the NNumbers Audit

The event keeps what the technical decision needs — path, rule, score, identifier — and leaves out what identifies or authenticates a person: credential, cookie, body and query parameter.

Roles and auditing

Role	What it can do
WAF Viewer (viewer)	View domains, metrics and events
WAF Editor (editor)	View, and manage policies, rules and exceptions
WAF Admin (admin)	Everything the Editor does, plus domains, activation and sensitive settings

Every administrative change is audited in the NNumbers Audit: who changed it, what changed and when. That includes creating an exception, changing a policy and activating a domain.

Shared responsibility

Topic	NNumbers	You
Edge, engine and rule set	Operates, updates in tested releases, with rollback available	—
Edge availability	Maintains the service and applies the last valid configuration	—
DNS	—	Maintain the records and the zone
Origin hardening	—	Restrict access, keep patches and TLS
Application vulnerabilities	—	Fix them in the code
False positives	Provides events, exceptions and the rule set version	Tune exceptions and paranoia level

Rule set updates arrive in tested, versioned releases, and rollback is possible. The applied version appears in events, so you can correlate a new block with a rule set change.

Limitations that affect security

• Volumetric layer 3 and 4 attacks are not contained by the WAF: they depend on the network protection in front.
• Response bodies are not inspected, so sensitive data returned by the application is not filtered by the WAF.
• WebSocket goes through the initial inspection, but frames after the upgrade are not evaluated.
• Rate limiting applies per edge instance, so it is not a hard global ceiling.
• A body above the policy limit is rejected with 413; the limit is not silently ignored.

Next steps

• Events and exceptions — auditing the fine tuning.
• Troubleshooting — 502 and the origin certificate.
• API — permissions and authentication for programmatic access.