Web application firewall

It reads each request (path, query string, headers, body size, rate per client) and answers 403, 413 or 429 itself, logging the rule that fired; everything else is passed on with X-Forwarded-For. Its rules catch known patterns, such as SQL injection or a scanner's user agent, not every way of writing them: a WAF is a filter in front of an application that must still be safe on its own, and its log is where false positives show first.

See it on real machines