Identify Web Application Firewalls protecting a site. Detect Cloudflare, AWS WAF, Akamai, and 100+ other security solutions.
WAFs often leave distinct footprints in headers, cookies, and error messages. We analyze these to identify the technology.
We check for vendor-specific headers (e.g., 'server: cloudflare', 'x-sucuri-id') that explicitly identify the WAF.
Many WAFs set specific tracking cookies (e.g., '__cfduid', 'incap_ses'). We analyze these to correlate with known vendors.
We send slightly malformed requests (like a safe SQLi payload) to provoke a blocking response, which often reveals the WAF's block page.
If we detect a WAF, we provide general tips on how it might be bypassed (e.g., origin IP discovery).
Attempts to find the real server IP address hiding behind the WAF proxy.
Recognizes over 100 WAF vendors including Cloudflare, Akamai, Imperva, AWS, and Azure.