The Transfer Has Triggered a Web Application Firewall: How to Unblock It

The transfer has triggered a Web Application Firewall is a Fortinet (and similar) error message. The WAF inspected the request, found something that matched a block rule, and stopped the transfer. The fix: investigate the rule that fired, modify the request to not match the rule, or whitelist the path with the WAF admin. The team that hits this on a file upload has a request that looks like an attack to the WAF.

Table of contents

• What triggered the WAF
• Where the WAF lives in the request path
• Investigating what rule fired
• The fix: change the request, or whitelist the path
• Common false positives
• How this fits the rest of the stack
• FAQ

What triggered the WAF

Common triggers:

1. Long URL or query string - URLs over 2-4 KB are sometimes blocked.

2. Suspicious user-agent - the WAF blocks user-agents that look like scanners (sqlmap, nikto, etc.).

3. Special characters in the path or body - characters that look like SQL injection (', ;, --), XSS (<script>, javascript:), or path traversal (../).

4. Specific blocked paths - /admin, /wp-admin, /.env, /.git, /phpmyadmin are commonly blocked.

5. Known attack signatures - the WAF matches request content against a signature database (like Snort rules for HTTP).

6. Rate limits - too many requests in a short time.

The team that sees the WAF message and the blocked URL in the error has a starting point for investigation.

Where the WAF lives in the request path

The WAF can be:

1. The web server itself - Apache mod_security, nginx with ModSecurity, IIS with URLScan.

2. A reverse proxy in front of the web server - Varnish, HAProxy, nginx, Caddy with WAF rules.

3. A network appliance - Fortinet FortiGate, F5 BIG-IP, Imperva, Barracuda, Cisco ASA with WAF module.

4. A cloud WAF service - Cloudflare WAF, AWS WAF, Azure WAF, Akamai Kona, Fastly.

5. A CDN-side WAF - Cloudflare, Fastly, Akamai, AWS CloudFront with Lambda@Edge.

The team that sees the WAF message needs to know which layer triggered it. The error message usually names the WAF (Fortinet, Cloudflare, etc.).

Investigating what rule fired

The WAF log shows the rule that fired. Where to find it:

• Fortinet FortiGate: Log & Report -> Security Events -> Web Filter (or Attack -> HTTP Anomaly).

• Cloudflare WAF: Security -> Events. The matched rule is in the event details.

• AWS WAF: CloudWatch logs or S3 access logs. The rule ID is in the log entry.

• Apache mod_security: /var/log/apache2/modsec_audit.log.

• nginx with ModSecurity: same, in nginx’s error log.

The team that finds the rule ID searches the WAF vendor’s docs for the rule description. Most rules are named with a category (SQL injection, XSS, scanner detection, etc.) and an ID.

The fix: change the request, or whitelist the path

Change the request if the rule is firing on a legitimate request. The team that has a path with a ' in it (e.g., a search query) URL-encodes it to %27 and the rule stops matching.

Whitelist the path if the rule is firing on a request that needs to pass. The team that has a legitimate admin endpoint blocked adds it to the WAF whitelist (the WAF admin’s job, not yours).

Disable the rule if the rule is too aggressive and is blocking legitimate traffic. The team that has a WAF blocking all POST requests because of one signature disables just that signature.

Add a custom rule for a new pattern. The team that has a new API endpoint that the WAF does not understand adds a custom rule to allow it.

Common false positives

1. A file upload with binary content - the WAF’s content inspection sees the binary and matches a signature (e.g., a JavaScript keyword in an image’s metadata). Whitelist the upload path or disable content inspection for the path.

2. A long JSON body - the WAF’s parser chokes on long input. Increase the WAF’s body size limit, or move the request to a different endpoint.

3. An API endpoint with special characters in the URL - URL-encode the special characters.

4. A SOAP/XML request with namespace URIs - the WAF’s XML parser misinterprets the namespaces. Whitelist the SOAP endpoint or use a different content type.

FAQ

How do I know which WAF blocked my request?

The error page usually shows the WAF name (Fortinet, Cloudflare, AWS, etc.) and sometimes a reference ID. The team that cannot tell from the error checks the Server or Via header in the response.

Can I disable the WAF?

Yes, but you lose the protection. The team that disables the WAF for development is fine; the team that disables it in production is exposed.

How do I whitelist a path in Cloudflare?

Cloudflare dashboard -> Security -> WAF -> Custom Rules -> Skip. Add a rule that matches the path and action ‘Skip’ for the WAF managed rules. The team that does this for a specific API endpoint has the path whitelisted.

Why does the WAF block my own requests?

The WAF is doing its job. The WAF inspects every request against its rules. Some rules have false positives (legitimate requests that look like attacks). The fix: tune the rule or whitelist the path.

What is the difference between a WAF and a regular firewall?

A regular firewall (iptables, pf) operates at the network layer (IP, port, protocol). A WAF operates at the HTTP layer (URL, headers, body, cookies). The WAF is for HTTP-specific attacks (SQL injection, XSS); the regular firewall is for network-level access control.

How this fits the rest of the stack

For a sense of what the full project costs before it commits, the RunxBuild hosting calculator shows the line items together. The API, the database, the storage, the worker, the bandwidth - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers.

Useful related references:

• How To Fix 400 Bad Request
• Npm Error Code 1
• The Transfer Has Triggered A Web Application Firewall