AWS WAF and Azure WAF Rules for PHP and Laravel Apps

Which AWS WAF managed rule groups and Azure WAF rule sets protect PHP and Laravel apps, with console steps and CLI commands for both clouds.

A Web Application Firewall (WAF) blocks known attack patterns before they reach your Laravel app. On AWS and Azure, managed rule sets give PHP apps solid protection in minutes, which matters most in the gap between a vulnerability being disclosed and your servers being patched.

Patching for the October 2026 PHP vulnerabilities? Start with PHP Security Patch October 2026: What Laravel Devs Must Do.

WAF Protection on AWS

AWS WAF protects Laravel apps behind CloudFront, an Application Load Balancer or API Gateway, including EC2, ECS and Elastic Beanstalk deployments.

Step 1: Enable AWS Managed Rule Groups

Managed Rule Group	Purpose
`AWSManagedRulesPHPRuleSet`	Blocks request patterns tied to PHP-specific vulnerabilities, including injection of unsafe PHP functions that enable remote code or command execution
`AWSManagedRulesKnownBadInputsRuleSet`	Blocks known exploit payloads; AWS adds new CVE signatures here
`AWSManagedRulesCommonRuleSet`	OWASP core protections for common web application threats
`AWSManagedRulesAmazonIpReputationList`	Blocks known malicious IPs based on Amazon threat intelligence

Console: go to AWS WAF → Web ACLs → your ACL → Rules → Add rules → Add managed rule groups and select the groups above.

Step 2: Add the Rule via CLI

{
  "Name": "AWS-PHPRuleSet",
  "Priority": 10,
  "Statement": {
    "ManagedRuleGroupStatement": {
      "VendorName": "AWS",
      "Name": "AWSManagedRulesPHPRuleSet"
    }
  },
  "OverrideAction": { "None": {} },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "AWSPHPRuleSet"
  }
}

aws wafv2 get-web-acl --name <acl-name> --scope REGIONAL --id <acl-id>
# Add the rule to the Rules array, then:
aws wafv2 update-web-acl --name <acl-name> --scope REGIONAL --id <acl-id> \
  --lock-token <token> --default-action Allow={} \
  --rules file://rules.json --visibility-config \
  SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=<acl-name>

Use --scope CLOUDFRONT (in us-east-1) for CloudFront distributions.

Tip: deploy new rules in Count mode for a few hours, review CloudWatch metrics for false positives, then switch to Block.

WAF Protection on Azure

Azure offers WAF on Application Gateway and Azure Front Door. Both use Microsoft-managed rule sets that include PHP attack detection (rule group PHP / 933xxx).

Step 1: Enable the Managed Rule Set

Service	Recommended Rule Set
Application Gateway WAF v2	DRS 2.1 (or OWASP CRS 3.2)
Azure Front Door Premium	Microsoft_DefaultRuleSet 2.1 + Microsoft_BotManagerRuleSet

Step 2: Apply It via CLI

Application Gateway:

az network application-gateway waf-policy create \
  --name laravel-waf --resource-group <rg>

az network application-gateway waf-policy managed-rule rule-set add \
  --policy-name laravel-waf --resource-group <rg> \
  --type Microsoft_DefaultRuleSet --version 2.1

az network application-gateway waf-policy policy-setting update \
  --policy-name laravel-waf --resource-group <rg> \
  --mode Prevention --state Enabled

Front Door:

az network front-door waf-policy create \
  --name laravelwaf --resource-group <rg> \
  --sku Premium_AzureFrontDoor --mode Prevention

az network front-door waf-policy managed-rules add \
  --policy-name laravelwaf --resource-group <rg> \
  --type Microsoft_DefaultRuleSet --version 2.1 --action Block

Make sure the PHP rule group (933xxx) is enabled and not overridden.

Tip: start in Detection mode, review logs in Log Analytics (AzureDiagnostics | where Category == "ApplicationGatewayFirewallLog"), then switch to Prevention.

WAF Is a Shield, Not a Cure

A WAF blocks known attack patterns. Attackers can encode or obfuscate payloads to get past it. Use it to buy time, keep managed rules on permanently, and still patch PHP and harden your web server.

Frequently Asked Questions

Which AWS WAF rule group protects PHP apps?

AWSManagedRulesPHPRuleSet, ideally combined with the Known Bad Inputs and Common rule sets.

Which Azure WAF rule set should I use for Laravel?

DRS 2.1 (Microsoft_DefaultRuleSet) on Application Gateway WAF v2 or Front Door Premium, with the PHP rule group enabled.

Can a WAF replace a PHP security patch?

No. A WAF reduces risk by blocking known attack patterns, but it can be bypassed. Upgrading PHP is the only full fix.

Need help setting up a WAF for your Laravel app? Talk to our team.

Official sources: AWS WAF Managed Rules · Azure WAF Rule Sets

SysNova Technologies, H NO 152 Muradgarhi, YEIDA Development Area, Gautam Buddh Nagar, 203209
Phone: +91 9793760210
Email: sales@sysnovatech.com