WAF · Fastly (Signal Sciences)
Fastly Next-Gen WAF
Difficulty 3/5
The Signal Sciences engine. Decides on request patterns and anomaly signals rather than on browser fingerprinting.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: medium
How it decides
-
Per-signal tagging of requests (SQLi, XSS, scraping-shaped traffic) with thresholds set per site.
-
Rate limiting and flagging by address over rolling windows, applied at the Fastly edge.
-
Behavioural rules driven by request-shape anomalies rather than device signals.
-
No TLS fingerprinting or JS challenge in the base product.
What you see when it stops you
- `x-sigsci-tags` or `x-sigsci-requestid` headers
- HTTP 406 responses — Signal Sciences’ signature block status
- `x-served-by` / `x-fastly-request-id` on the same response
Signatures the detector matches
Publicly observable artefacts Fastly Next-Gen WAF sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Header | x-sigsci-tags header | 75 |
| Header | x-sigsci-requestid header | 70 |
| Header | x-fastly-request-id header | 25 |
| Header | Fastly x-served-by header | 15 |
| Status | 406 — Signal Sciences block status | 20 |
What actually gets through
-
Static ISP addresses with sane rotation. Address quality is not the deciding factor; request shape is.
-
Vary paths and parameters — identical repeated request signatures are what raise the anomaly score.
-
Stay well under the rate threshold; blocks here are almost always velocity-driven.
Hosts on record running it
From the detector's curated database. Observed, not live — stacks change, and large sites often run different protection per market.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.