> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apitraffic.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Install the WAF

> Protect your Node application with the ApiTraffic Web Application Firewall

The ApiTraffic Web Application Firewall runs inside your application and inspects inbound requests before they reach your route handlers. Policies are managed in ApiTraffic and pushed to connected application instances automatically.

The WAF is an optional addition to an existing ApiTraffic framework integration. It supports Express, Fastify, Koa, and Hapi.

## Install

```bash npm theme={null}
npm install @apitraffic/waf
```

```bash yarn theme={null}
yarn add @apitraffic/waf
```

```bash pnpm theme={null}
pnpm add @apitraffic/waf
```

## Add the middleware

Register the WAF after ApiTraffic and any middleware that parses request bodies, but before your routes. This lets the WAF inspect parsed request data and stop blocked requests before your application handles them.

**Express**

```javascript theme={null}
const express = require('express');
const apiTraffic = require('@apitraffic/express');
const waf = require('@apitraffic/waf');

const app = express();

app.use(express.json());
app.use(apiTraffic({
  token: process.env.API_TRAFFIC_TOKEN,
  bucket: process.env.API_TRAFFIC_BUCKET
}));
app.use(waf.express());

app.get('/api/users', (req, res) => {
  res.json({ users: [] });
});
```

**Fastify**

```javascript theme={null}
const waf = require('@apitraffic/waf');

fastify.addHook('onRequest', waf.fastify());
```

**Koa**

```javascript theme={null}
const waf = require('@apitraffic/waf');

app.use(waf.koa());
```

**Hapi**

```javascript theme={null}
const waf = require('@apitraffic/waf');

server.ext('onPreHandler', waf.hapi());
```

> [!WARNING]
>
> Middleware order matters. The WAF must run before your route handlers to prevent blocked requests from reaching application code.

## Create a policy

1. Open **WAF** in the ApiTraffic dashboard.
2. Select **Add WAF Policy**.
3. Choose the environments and buckets the policy protects.
4. Start in **Monitor** mode. Matching requests continue normally while you review detections in **WAF → Insights**.
5. Change the policy to **Enforcing** when you are ready to block matching requests.

Policy changes are delivered to connected servers automatically. You do not need to redeploy your application when you tune a policy or change its mode.

## Verify

1. Start your application and send normal traffic through a protected endpoint.
2. Open **WAF → Insights** and confirm that the application is reporting WAF activity.
3. Review detections while the policy is in **Monitor** mode before switching to **Enforcing**.

## Disable the WAF locally

Set the environment variable below as an emergency, process-level kill switch:

```bash .env theme={null}
API_TRAFFIC_WAF_ENABLED=false
```

You can also disable it in code:

```javascript theme={null}
app.use(waf.express({ enabled: false }));
```

Both options make the middleware pass requests through without evaluating the active policy.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.