GAJWAF Playbook: Responding to an Active Website Attack

Overview

When a website or business-critical application comes under active cyberattack, responding quickly is essential. However, aggressive security measures applied without proper assessment can inadvertently disrupt legitimate users and business operations.

The GAJWAF Site Under Active Attack Playbook provides a structured, six-step incident-response procedure to help security teams identify, contain and recover from active attacks against protected websites and applications.

The playbook focuses on stopping malicious activity quickly, identifying attack sources and refining security controls while maintaining access for legitimate users.

The guiding principle is simple: Confirm. Enforce. Then Refine.

What You'll Learn

This playbook covers six essential stages of responding to an active attack.

Step 1: Confirm That an Attack Is Taking Place

Learn how to analyze security events and traffic patterns to distinguish genuine attacks from legitimate traffic spikes or backend service failures.

The guide explains how to identify suspicious activity, affected applications, attack signatures and originating networks.

Step 2: Ensure Security Enforcement Is Active

Verify that the affected application is operating in Block mode and that malicious requests are being actively blocked rather than merely detected.

The playbook also explains how to adjust security levels and blocking sensitivity when confirmed attacks are not being stopped.

Step 3: Activate Under-Attack Mode

Learn when and how to enable GAJWAF's Under-Attack Mode to introduce additional browser verification during automated attacks or malicious traffic surges.

The guide also addresses handling API clients, mobile applications and server-to-server integrations that may not support browser challenges.

Step 4: Identify and Restrict Attack Sources

Understand how to apply targeted security controls based on the nature and origin of the attack.

The playbook covers:

• Blocking identified malicious IP addresses.
• Applying geographic and network-based restrictions.
• Restricting suspicious traffic originating from Tor or hosting networks.
• Adjusting rate limits and automatic banning thresholds.
• Using custom security rules and virtual patching to address targeted attacks.

Step 5: Monitor and Adjust Protection

Continuously monitor blocked requests, application availability and backend health to confirm that security measures are effective.

Learn how to refine overly restrictive controls when legitimate users or business integrations are affected.

Step 6: Recover and Strengthen Security

After the attack subsides, review temporary restrictions, retain useful long-term protections and restore normal application operations.

The playbook also explains how to document the incident and incorporate effective defensive measures into the application's ongoing security configuration.

Why This Playbook Matters

During an active attack, security teams must balance rapid threat containment with service availability.

Following this playbook helps organizations:

• Respond systematically to active application-layer attacks.
• Reduce the time required to identify and contain malicious activity.
• Activate appropriate protection without unnecessarily affecting legitimate users.
• Apply targeted blocking, bot protection and rate-limiting controls.
• Monitor application health throughout the incident.
• Restore normal operations after the attack.
• Maintain incident records for security reviews and future improvements.

Incident Recovery and Validation

The playbook includes an incident-closure checklist to verify that:

• Malicious traffic has subsided.
• Legitimate users can access the application normally.
• Backend services are healthy and responsive.
• Temporary security measures have been reviewed.
• Incident details and response actions have been documented.

An incident-record template is also included to capture affected applications, attack sources, detection rules, containment measures and recovery information.

Download the Playbook

Document: GAJWAF Playbook – Site Under Active Attack
Document Type: Incident Response Playbook
Publication: October 2026
Pages: 7
Intended Audience: GAJWAF Security Analysts and Administrators

Attachment: GAJWAF_Playbook_Site_Under_Attack.pdf

Download the attached playbook for detailed incident-response procedures, configuration references, operational guidance and the incident-closure checklist.

Related Documentation

For additional guidance, refer to:

• GAJWAF Playbook – Taming False Positives: Resolve legitimate traffic being incorrectly blocked during incident response.
• GAJWAF Playbook – DDoS / Layer-7 Flood: Respond to high-volume application-layer traffic attacks.
• GAJWAF Troubleshooting & Support Manual: Investigate attacks bypassing security controls and diagnose backend connectivity problems.
• GAJWAF Features & Configuration Guide: Configure geographic restrictions, bot protection, rate limits, custom rules and virtual patching.

Technical Support

For assistance during an active security incident or with GAJWAF configuration, contact GajShield Technical Support or your authorized GajShield partner.

Website: https://www.gajshield.com

GAJWAF: Different Applications. Different Protection. Shared Risk Intelligence.