Skip to main content

Overview

IO River provides consistent security services at the edge. These services are managed via the IO River console and include:

  • Managed WAF – Pre-configured security rulesets that protect against common web threats. Provides out-of-the-box coverage for vulnerabilities like SQL injection, XSS, and known attack patterns, reducing the need for manual rule creation and ongoing maintenance. Users can choose one of the following managed WAF providers:
    • IO River's managed WAF
  • Custom Rules – Allow you to define specific conditions and actions to inspect and control incoming web traffic.
  • Rate Limiting – Controls the number of requests a client or IP can make to your application within a specified time window. Helps protect against abuse, credential stuffing, DDoS attacks, and excessive API calls by automatically throttling or blocking traffic that exceeds the defined limits.

Security services are executed in the following order:

  1. Custom rules
  2. Rate limiting
  3. Managed WAF

Enabling Security Services

Security services are disabled by default for new services. You can enable them at the service level via the IO River console.
Please note that IO River's security services use edge compute, which may incur additional costs from your CDN provider.

To enable security services for your service:

  1. Navigate to your service.
  2. In the sidebar, select Security, then select WAF.
  3. Click on Enable Edge Security.

Note: Security services must be enabled for your account before enabling them for a service. You can contact us at support@ioriver.io to enable this feature.