Link cloaking

To prevent web pages in your application from being scanned by web crawlers and scanning software, you can use link cloaking to transform the fixed links to automatically generated links by JavaScript codes. For example, <a href="https://www.google.com" target="blank" class="button"> will be transformed to <a id="fwb_4069875712" target="blank" class="button"> so that the crawlers can't recognize it. When the link is loaded in the client's browser, it will be re-converted to the original link.

Link cloaking supports processing the following link tags: <a>, <form>, <img>, <link>, and <object>.

FortiWeb has a similar feature which processes URL links, that is, URL Encryption. URL Encryption encrypts the domain directory, so that the attack can't guess the URLs of internal pages that are not directly linked from the home page. For instance, an attacker could manually modify the URL to access example.com/admin or example.com/backups, hoping these directories are poorly secured or not monitored.

While Link cloaking processes the links presented on a web page. It searches the link tags such as <a> and <form> on a web page and obscure the links so that web crawlers can't recognize them.

	Before	After
URL Encryption	User Account Page URL: https://www.secureshop.com/user/account/12345 Order History URL: https://www.secureshop.com/orders/history	Encrypted User Account Page URL: https://www.secureshop.com/7d93jd83jd3f Encrypted Order History URL: https://www.secureshop.com/8fh83hf8hf8h
Link Cloaking	URL link on a page: <a href="https://www.secureshop.com/login" target="blank" class="button">	Cloaked Link: <a id="fwb_4069875712" target="blank" class="button">

, for example, , instead, it encrypts the link itself. For example, <a href="https://example/login"> will be transformed to <a href="EncryptedCode"> by URL Encryption. It can't prevent the links from being scanned by web crawlers because the link tag href is still there.

To configure a link cloaking rule:

1. Go to Web Protection > Advanced Protection > Link Cloaking.
2. Select Link Cloaking Rule.
3. Configure the following settings.

   Name	Enter a name for the rule.
   Host Status	Enable to require that the Host: field of the HTTP request matches a protected host name entry in order to match the link cloaking rule.
   Host	Select the protected host names entry (either a web host name or a IP address) that the Host: field of the HTTP request must be in to match the rule.
   Type	Select whether the URL Pattern field must contain either: Simple String—The field is a string that the request URL must match exactly. Regular Expression—The field is a regular expression that defines a set of matching URLs.
   URL Pattern	Depending on your selection in Type, enter either: The literal URL, such as /folder1/index.htm that the HTTP request must contain in order to match the rule, or use wildcards to match multiple URLs, such as /folder1/* or /folder1/*/index.htm. The URL must begin with a slash ( / ). A regular expression, such as ^/*.php. This pattern does not require beginning with a slash ( / ); however, it must match URLs that begin with a slash. Do not include the domain name, such as www.example.com, which is configured separately in the Host drop-down list. To create and test a regular expression, click the >> (test) icon. This opens the Regular Expression Validator window where you can fine-tune the expression. For details, see Regular expression syntax. FortiWeb will find the link tags on the matched URL pages, then encrypt the links.

4. Click OK.
5. If you want to exclude certain links from Link Cloaking, click Create New to add it in the Exception List. Then type a literal URL or use regular expression to match multiple URLs.

To configure a Link Cloaking policy:

1. Go to Web Protection > Advanced Protection > Link Cloaking
2. Select Link Cloaking Policy.
3. Enter a name for the Link Cloaking policy.
4. Click OK.
5. Click Create New to add Link Cloaking rules in the policy.
6. Select the Link Cloaking rule.
7. Click OK.

To use this policy, you need to refer it in a web protection profile.