Filters

Filters are one of the primary security mechanisms used by WEDOS.protection proxy servers to block malicious and unwanted traffic before it reaches your web server. They allow WEDOS.protection to stop threats based on where traffic comes from, how it is identified, or which part of the website is targeted.

By combining automated AI-driven protection with optional custom rules, filters give you both strong default security and fine-tuned control when needed.

How Filters Work

WEDOS.protection filters operate on the proxy level. This means that traffic is analyzed and filtered before it reaches your origin server, reducing load and preventing malicious requests from ever touching your infrastructure.

Filters are enabled in AI Mode by default. In this mode, the system automatically evaluates traffic patterns and blocks requests that are identified as threats. WEDOS.protection uses years of historical data and continuously adapts to the evolving global cybersecurity landscape.

AI Mode is always active and cannot be disabled. Start and Advanced plans use AI Mode only, while users with an Expert subscription plan or higher can add custom filter rules on top of AI protection for additional control.

Accessing Filters in the Dashboard

To manage filters in the WGP dashboard, select a domain and then navigate to Filters under the Domain details.

Types of Filters in WEDOS.protection

WEDOS.protection currently supports the following filters, each designed to address different categories of traffic. These filters are in AI mode by default, which means that any event recognized as a threat automatically informs the entire system’s decisions on how to handle it. Users with the Expert subscription plan and above can enable Custom settings in addition to AI Mode.

IP Filter

The IP Filter blocks traffic coming from specific IP addresses or IP ranges.

This filter is especially useful when:

• An attack originates from a single IP address.
• A small subnet is generating unwanted traffic.
• You want to immediately block a known malicious source.

ASN Filter

The ASN Filter blocks traffic based on Autonomous System Numbers (ASNs). An Autonomous System represents a group of IP networks operated by an organization such as an ISP, hosting provider, or cloud service. Blocking an ASN allows you to stop traffic from an entire network rather than individual IP addresses.

This filter is effective when:

• Attacks originate from large hosting providers.
• Malicious traffic rotates across many IPs within the same network.

URL Filter

The URL Filter protects specific URLs or paths on the domain.

Unlike IP or ASN filters, which block traffic sources, the URL Filter blocks access to selected addresses on the website. This is commonly used to protect sensitive endpoints such as login pages or administrative paths.

For example, you can block traffic to:

• /wp-admin/
• /login
• Other application-specific URLs.

User Agent Filter

A User Agent identifies the type of client making a request, such as a browser, crawler, or automated tool. This information is sent in the User-Agent HTTP header.

The User Agent Filter blocks requests that match specific user agent strings. This can help stop:

• Known malicious crawlers.
• Web scrapers.
• Bots using identifiable or suspicious user agents.

JA4 TLS Fingerprint Filter

A JA4 fingerprint is created at the TLS-termination layer and allows classification of the client stack and not just the header. By capturing and hashing these characteristics in a consistent way, you get a stable fingerprint that’s tied to the client’s technology stack (TLS library, OS, runtime), not its self-declared identity. This filter is especially helpful for avoiding false positives.

JA4H HTTP Fingerprint Filter

This is the same as JA4 but based on a client’s HTTP request. This filter is especially helpful for catching bots that match a browser at the TLS level but expose themselves at the HTTP layer.

Referer Filter

The Referer HTTP header indicates the page or domain that linked to the current request.

Useful for blocking:

• Referral spam.
• Content scrapers.
• Traffic originating from known malicious or unwanted domains.

Commonly used to prevent hotlinking (other sites embedding your images, videos, or assets directly) and to stop fake referrer traffic used to pollute analytics.

Content-Type Filter

The Content-Type HTTP header declares the format of the request body (e.g. application/json, multipart/form-data, application/x-www-form-urlencoded, text/xml). Useful for restricting your application or API to only the payload types it expects — for example:

• Blocking file uploads on endpoints that should only receive JSON.
• Rejecting XML/SOAP on JSON-only APIs.
• Stopping malformed and unusual content types commonly produced by automated tools and exploit scanners.

IP Category Filter

Filters traffic based on the type of network the source IP belongs to, rather than the IP address itself. WGP classifies each client IP into categories such as:

• Datacenter / hosting provider.
• Residential ISP.
• Mobile carrier.
• TOR / VPN / anonymising proxy.
• Search engine crawler.
• Similar groups.

This lets you apply broad, intent-based rules without having to maintain individual IP lists — for example, allowing residential and verified search-engine traffic, challenging datacenter traffic, and dropping TOR/VPN traffic outright.

Custom Filters

Enable custom filters by clicking the toggle switch next to the specific filter, then adding the data you want to filter in the dropdown section. For each custom filter item you create you can choose one of the following actions:

• Allow access / Whitelist. Bypass all protection layers and deliver the request directly to the origin server. Use only for trusted, well-identified traffic (e.g. a verified internal monitoring system).
• CAPTCHA verification (Proof of Work). Serve a Proof of Work / bot challenge before allowing the request through.
• Block with error page (HTTP 456). Block the request and return a customizable error page with HTTP status 456.
• Block silently (drop traffic). Silently discard the request. The client receives no response. Useful against attack traffic where you do not want to confirm the request reached a server.

What Happens When Traffic Is Blocked

When a request is blocked by a filter:

• Browser requests see an Access Denied error page.
• Non-browser requests receive an HTTP 456 response code.

These responses clearly indicate that traffic was stopped by WEDOS.protection before reaching the origin server.