WAF · Sucuri (GoDaddy)
Sucuri Website Firewall
Difficulty 2/5
A cloud WAF aimed at WordPress and small-business hosting. Signature and reputation rules, no device fingerprinting.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: medium
How it decides
-
Known-bad address lists and CMS-specific attack signatures at a reverse proxy.
-
Simple rate limiting and geo-blocking.
-
An optional JS/cookie check for suspicious clients.
What you see when it stops you
- “Access Denied - Sucuri Website Firewall”
- `x-sucuri-id` or `x-sucuri-cache` headers
- `server: Sucuri/Cloudproxy`
Signatures the detector matches
Publicly observable artefacts Sucuri Website Firewall sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Header | x-sucuri-id header | 75 |
| Header | x-sucuri-cache header | 65 |
| Header | server: Sucuri/Cloudproxy | 60 |
| Page markup | Sucuri block page | 70 |
What actually gets through
-
Static ISP addresses are ample. Rotate on 403 and keep a browser-shaped header set.
-
Avoid anything that pattern-matches a CMS exploit scan — that is what the rules are written for.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.