Is my website supported by the WAF?
The WAF supports all websites that do not have an apex domain name. Apex domain names are domain names that consist only of the top-level domain indicator (.com, .co.uk, .org) and exactly one subdomain. This is not an artificial limitation neither one imposed by the WAF per se. The problem is that an apex domain record cannot be a CNAME, and WAF setup requires that the website domain is a CNAME pointing to the WAF.
Examples of apex domain names (not supported by the WAF):
Examples of non-apex domain names (supported by the WAF):
If your website uses a non-apex domain starting with www. but your server is also accessible under the apex domain, then this setup is supported: we will ask you to point your main website to the WAF, and the apex domain to a special server of ours that redirects the request to the WAF, by appending www. to the original domain name. Essentially the WAF supports the apex domain as a “landing” page, simply in order to redirect the requests to the real website (the www. domain).
It is important that you implement this part of the WAF configuration, otherwise attackers are able to deduce your server’s real IP simply by looking up the apex domain name.