Sequence of scans

Sequence of scans

FortiWeb applies protection rules and performs protection profile scans in the order of execution according to the below table. To understand the scan sequence, read from the top of the table (the first scan/action) toward the bottom (the last scan/action). Disabled scans are skipped.

You may find the actual scan sequence sometimes is different from what we list below in the scan sequence table. There might be various reasons, for example, for the scans involving the whole request or response package, its sequence may vary depending on when the package is fully transferred to FortiWeb. File Security is one of the scan items that involve scanning the whole package. FortiWeb scans Content-Type: and the body of the file for File Security. While the Content-Type: is scanned instantly, the body of the file may be postponed after the subsequent scans until the whole body of the file is done uploading to FortiWeb.

Please also note that when we talk about scan sequence, it refers to the sequence within the same package. For example, HTTP Request Limit precedes the TCP Connection Number Limit in the scan sequence table. However, if there are two pakages containing HTTP traffic and TCP traffic respectively, and the TCP package arrives first, FortiWeb thus checks the TCP Connection Number Limit first.

To improve performance, block attackers using the earliest possible technique in the execution sequence and/or the least memory-consuming technique. The blocking style varies by feature and configuration. For example, when detecting cookie poisoning, instead of resetting the TCP connection or blocking the HTTP request, you could log and remove the offending cookie. For details, see each specific feature.

**Execution sequence (web protection profile)**
Scan/action	Involves
Request from client to server
Add X-Forwarded-For:	`X-Forwarded-For:` `X-Real-IP:` `X-Forwarded-Proto:`
IP List * (individual client IP black list or white list)	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. Source IP address of the client in the IP layer.
IP Reputation	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers.
Quarantined source IP addresses	Source IP address of the client in the IP layer.
Allow Known Search Engines	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. Source IP address of the client in the IP layer.
Geo IP	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. Source IP address of the client in the IP layer.
WebSocket protocol	`Host:` URL in HTTP header `Origin:` `Upgrade:` Frame Size/Message Size `sec-websocket-extenstions`
Add HSTS Header	`Strict-Transport-Security:`
Protected Server Check	`Host:`
Allow Method	`Host:` URL in HTTP header Request method in HTTP header
Session Management	`Cookie:` Session state
Mobile Application Identification	Token header
HTTP Request Limit/sec (HTTP Flood Prevention)	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Cookie:` Session state URL in the HTTP header HTTP request body
TCP Connection Number Limit (Malicious IP)	`Cookie:` Session state Source IP address of the client in the IP layer Source port of the client in the TCP layer
HTTP Request Limit/sec (Shared IP) (HTTP Access Limit)	`ID` field of the IP header Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. HTTP request body
TCP Connection Number Limit (TCP Flood Prevention)	Source IP address of the client in the IP layer. Source port of the client in the TCP layer.
Brute Force Login	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. URL in the HTTP header Source port of the client in the TCP layer `ID` field of the IP header `Host:`
HTTP Authentication	`Authorization:`
Configuring the global object white list	`Cookie: cookiesession1` URL if `/favicon.ico`, AJAX URL parameters such as `__LASTFOCUS`, and others as updated by the FortiGuard Security Service.
ADFS Proxy	`Host:` URL in HTTP header Request method in HTTP header Other request headers, especially the X-MS-* headers Parameters in the URL Cookies
Site Publish	`Host:` `Cookie:` URL of the request for the web application
URL Access	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Host:` URL in HTTP header Source IP of the client in the IP header
WebSocket protocol	`Host:` URL in HTTP header Token header
Padding Oracle Protection	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Host:` URL in HTTP header Individually encrypted URL, cookie, or parameter
HTTP Protocol Constraints	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Content-Length:` Parameter length Body length Header length Header line length Count of `Range:` header lines Count of cookies
Start Pages	`Host:` URL in HTTP header Session state
Page Access (page order)	`Host:` URL in HTTP header Session state
File Security	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Content-Type:` in `PUT` and `POST` requests URL in HTTP header The body of the file
Parameter Validation	`Host:` URL in the HTTP header Name, data type, and length
File Uncompress	`Content-Type:`
Web Cache	`Host:` URL in the HTTP header Size in kilobytes (KB) of each URL to cache
Machine Learning - Bot Detection	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Host:` URL in the HTTP header HTTP version `Content-Type:` Response status code Request method in HTTP header `Referer:` `User-Agent:`
Defeating cross-site request forgery (CSRF) attacks	`<a href>` `<form>`
Protection for Man-in-the-Browser (MiTB) attacks	`Host:` URL in HTTP header Request method in HTTP header Parameters in URL `Content-Type:`
Bot Mitigation	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers URL `Host:` `X-Forwarded-For:`
XML Protection	URL HTTP header Body
JSON Protection	URL HTTP header Body
Signatures	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. HTTP headers HTML Body URL in HTTP header Parameters in URL and request body
Device Reputation	Cookies and other headers URL in HTTP header Request method in HTTP header Parameters in URL Multipart filename
Hidden Fields Protection	`Host:` URL in the HTTP header Name, data type, and length of `<input type="hidden">`
Custom Policy	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers URL in the HTTP header HTTP header Parameter in the URL, or the HTTP header or body
User Tracking	`Host:` `Cookie:` Parameters in the URL URL in HTTP header HTTP body Client's certificate
API Gateway	`Host:` URL in HTTP header API Key as HTTP parameter in URL API Key as HTTP header Source IP address of the client depending on your configuration of API user Request methods in HTTP header HTTP Referer depending on your configuration of API user
OpenAPI Validation	`Host:` HTTP headers, especially the `content-type:` headers URL in HTTP header Request method in HTTP header Parameters in URL Multipart filename
XML Validation	`Host:` URL in HTTP header HTTP request headers & body
CORS Protection	`Host:` URL in HTTP header `Origin:` Request methods in HTTP header HTTP headers including `Access-Control-Allow-Origin`, `Access-Control-Request-Method`, `Access-Control-Request-Headers`, `Access-Control-Max-Age`, `Access-Control-Expose-Headers`, `Access-Control-Allow-Credentials`, `Access-Control-Allow-Methods`, and `Access-Control-Allow-Headers`.
URL Rewriting (rewriting & redirects)	`Host:` `Referer:` `Location:` URL in HTTP header HTML body
Machine Learning - Anomaly Detection	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers URL in the HTTP header Request method in HTTP header Parameter in the URL, or the HTTP header or body `Content-Type:`
File Compress	`Accept-Encoding:`
Cookie Security Policy	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers `Cookie:`
Reply from server to client
Configuring a protection profile for inline topologies	`Content-Encoding:`
Hidden Fields Protection	`Host:` URL in the HTTP header Name, data type, and length of `<input type="hidden">`
Custom Policy	HTTP response code Content Type
URL Rewriting (rewriting)	`Host:` `Referer:` `Location:` URL in HTTP header HTML body
Web Socket Protocol	`Upgrade:`
Chunk Decoding	Transfer-Encoding Raw body
Protection for Man-in-the-Browser (MiTB) attacks	Status code Response body
Signatures	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers HTTP headers HTML Body URL in HTTP header Parameters in URL and body XML in the body of HTTP POST requests Cookies Headers JSON Protocol Detection Uploaded filename (MULTIPART_FORM_DATA_FILENAME)
Device Reputation	Status code `Content-Type:` HTML body
Bot Mitigation	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers URL `Host:` `X-Forwarded-For:` HTTP header Custom signature Body The latest HTTP transaction time The response content type Status code
User Tracking	Status code HTTP headers HTML body
HTTP Header Security	HTTP headers
* If a source IP is white listed, subsequent checks will be skipped.

Sequence of scans

**Execution sequence (web protection profile)**
Scan/action	Involves
Request from client to server
Add X-Forwarded-For:	`X-Forwarded-For:` `X-Real-IP:` `X-Forwarded-Proto:`
IP List * (individual client IP black list or white list)	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. Source IP address of the client in the IP layer.
IP Reputation	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers.
Quarantined source IP addresses	Source IP address of the client in the IP layer.
Allow Known Search Engines	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. Source IP address of the client in the IP layer.
Geo IP	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. Source IP address of the client in the IP layer.
WebSocket protocol	`Host:` URL in HTTP header `Origin:` `Upgrade:` Frame Size/Message Size `sec-websocket-extenstions`
Add HSTS Header	`Strict-Transport-Security:`
Protected Server Check	`Host:`
Allow Method	`Host:` URL in HTTP header Request method in HTTP header
Session Management	`Cookie:` Session state
Mobile Application Identification	Token header
HTTP Request Limit/sec (HTTP Flood Prevention)	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Cookie:` Session state URL in the HTTP header HTTP request body
TCP Connection Number Limit (Malicious IP)	`Cookie:` Session state Source IP address of the client in the IP layer Source port of the client in the TCP layer
HTTP Request Limit/sec (Shared IP) (HTTP Access Limit)	`ID` field of the IP header Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. HTTP request body
TCP Connection Number Limit (TCP Flood Prevention)	Source IP address of the client in the IP layer. Source port of the client in the TCP layer.
Brute Force Login	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. URL in the HTTP header Source port of the client in the TCP layer `ID` field of the IP header `Host:`
HTTP Authentication	`Authorization:`
Configuring the global object white list	`Cookie: cookiesession1` URL if `/favicon.ico`, AJAX URL parameters such as `__LASTFOCUS`, and others as updated by the FortiGuard Security Service.
ADFS Proxy	`Host:` URL in HTTP header Request method in HTTP header Other request headers, especially the X-MS-* headers Parameters in the URL Cookies
Site Publish	`Host:` `Cookie:` URL of the request for the web application
URL Access	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Host:` URL in HTTP header Source IP of the client in the IP header
WebSocket protocol	`Host:` URL in HTTP header Token header
Padding Oracle Protection	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Host:` URL in HTTP header Individually encrypted URL, cookie, or parameter
HTTP Protocol Constraints	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Content-Length:` Parameter length Body length Header length Header line length Count of `Range:` header lines Count of cookies
Start Pages	`Host:` URL in HTTP header Session state
Page Access (page order)	`Host:` URL in HTTP header Session state
File Security	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Content-Type:` in `PUT` and `POST` requests URL in HTTP header The body of the file
Parameter Validation	`Host:` URL in the HTTP header Name, data type, and length
File Uncompress	`Content-Type:`
Web Cache	`Host:` URL in the HTTP header Size in kilobytes (KB) of each URL to cache
Machine Learning - Bot Detection	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. `Host:` URL in the HTTP header HTTP version `Content-Type:` Response status code Request method in HTTP header `Referer:` `User-Agent:`
Defeating cross-site request forgery (CSRF) attacks	`<a href>` `<form>`
Protection for Man-in-the-Browser (MiTB) attacks	`Host:` URL in HTTP header Request method in HTTP header Parameters in URL `Content-Type:`
Bot Mitigation	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers URL `Host:` `X-Forwarded-For:`
XML Protection	URL HTTP header Body
JSON Protection	URL HTTP header Body
Signatures	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers. HTTP headers HTML Body URL in HTTP header Parameters in URL and request body
Device Reputation	Cookies and other headers URL in HTTP header Request method in HTTP header Parameters in URL Multipart filename
Hidden Fields Protection	`Host:` URL in the HTTP header Name, data type, and length of `<input type="hidden">`
Custom Policy	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers URL in the HTTP header HTTP header Parameter in the URL, or the HTTP header or body
User Tracking	`Host:` `Cookie:` Parameters in the URL URL in HTTP header HTTP body Client's certificate
API Gateway	`Host:` URL in HTTP header API Key as HTTP parameter in URL API Key as HTTP header Source IP address of the client depending on your configuration of API user Request methods in HTTP header HTTP Referer depending on your configuration of API user
OpenAPI Validation	`Host:` HTTP headers, especially the `content-type:` headers URL in HTTP header Request method in HTTP header Parameters in URL Multipart filename
XML Validation	`Host:` URL in HTTP header HTTP request headers & body
CORS Protection	`Host:` URL in HTTP header `Origin:` Request methods in HTTP header HTTP headers including `Access-Control-Allow-Origin`, `Access-Control-Request-Method`, `Access-Control-Request-Headers`, `Access-Control-Max-Age`, `Access-Control-Expose-Headers`, `Access-Control-Allow-Credentials`, `Access-Control-Allow-Methods`, and `Access-Control-Allow-Headers`.
URL Rewriting (rewriting & redirects)	`Host:` `Referer:` `Location:` URL in HTTP header HTML body
Machine Learning - Anomaly Detection	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers URL in the HTTP header Request method in HTTP header Parameter in the URL, or the HTTP header or body `Content-Type:`
File Compress	`Accept-Encoding:`
Cookie Security Policy	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers `Cookie:`
Reply from server to client
Configuring a protection profile for inline topologies	`Content-Encoding:`
Hidden Fields Protection	`Host:` URL in the HTTP header Name, data type, and length of `<input type="hidden">`
Custom Policy	HTTP response code Content Type
URL Rewriting (rewriting)	`Host:` `Referer:` `Location:` URL in HTTP header HTML body
Web Socket Protocol	`Upgrade:`
Chunk Decoding	Transfer-Encoding Raw body
Protection for Man-in-the-Browser (MiTB) attacks	Status code Response body
Signatures	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers HTTP headers HTML Body URL in HTTP header Parameters in URL and body XML in the body of HTTP POST requests Cookies Headers JSON Protocol Detection Uploaded filename (MULTIPART_FORM_DATA_FILENAME)
Device Reputation	Status code `Content-Type:` HTML body
Bot Mitigation	Source IP address of the client depending on your configuration of X-header rules. This could be derived from either the `SRC` field in the IP header, or the `X-Forwarded-For:` and `X-Real-IP:` HTTP headers. For details, see Defining your proxies, clients, & X-headers URL `Host:` `X-Forwarded-For:` HTTP header Custom signature Body The latest HTTP transaction time The response content type Status code
User Tracking	Status code HTTP headers HTML body
HTTP Header Security	HTTP headers
* If a source IP is white listed, subsequent checks will be skipped.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

Administration Guide