What kokiGUARD handles every day
Sixteen situations that we see at our hosted clients. For each one: the problem, what kokiGUARD does, and the chapter that shows you how.
A critical vulnerability is published for a module of your CMS
A vulnerability is published on a Friday evening for a WordPress plugin or a PrestaShop module. From the next day, robots exploit it on a large scale, before your agency can update the site.
Kokiris publishes a rule that blocks this vulnerability in its rulesets, often on the same day. On 17 September 2026, nine vulnerabilities of WordPress plugins were covered on the same day. The bell of the panel tells you about each new protection.
Robots look for your secret files
A few hours after a server goes online, it already receives requests for /.env or /.git/config. These files contain database passwords and API keys.
The OWASP rules recognize these attempts to read files and block them. In Ban mode, the address that continues is banned from all your sites.
Robots scrape your catalogue
Robots go through all the filter combinations of your shop (size, colour, brand…). The server saturates, and your prices end up at a competitor.
The Kokiris PrestaShop ruleset finds these abnormal filter paths and increases the reputation of the robot until it is banned, and it never disturbs a real client. Rate limiting and the JS challenge complete the protection.
A robot tries thousands of URLs and triggers no rule
It presents itself as a browser and requests pages that do not exist, one after the other, to find a forgotten backup or a badly protected admin area. No request looks like an attack: in October 2026, on one shop, it received thousands of 404 responses and not one detection.
kokiGUARD counts the errors that your sites send to each address. Above 60 per minute, the address appears in the logs. Then, if you choose it, the address is banned from all your sites.
Someone tries every password
A robot sends thousands of login attempts to /wp-login.php or to your back office.
A limit of 5 attempts per minute sends a 429 error from the sixth attempt. Then the progressive ban keeps the address out for 10 minutes, 6 hours or 24 hours.
AI robots copy your product pages
AI training robots go through your full catalogue, several times per day. They use your server and bring no client. Other robots pretend to be Googlebot so that they are not blocked.
The “Robots and crawlers” card of the site blocks, limits or challenges each known robot, and keeps the search engines. kokiGUARD checks the address of the robots that publish their ranges: it recognizes a fake Googlebot as an impostor.
A robot continues, but your clients share its address
A robot goes through the same proxy as the computers of a large client company. If you ban its address, you also cut off your clients.
In Challenge mode, the address is not banned: it must solve a small calculation that every browser does by itself, in less than one second. The clients get through, the robot stays outside.
The sales start at 8 a.m.
Thousands of clients arrive at the same time. Without precautions, the site slows down, then goes down for everyone.
The waiting room queue sets a maximum number of simultaneous visitors. The next visitors wait on a dedicated page and enter when a place becomes free. The site stays fast for the people who buy.
Your agency deploys a new version
During the update, the site shows errors or a half-loaded page to your clients.
Maintenance mode shows a clean page on the full site, except on the paths that you exempt, for example !/api so that your applications continue to work.
A partner gets blocked
Your carrier, your ERP or your monitoring probe calls your site hundreds of times per hour, with requests that the WAF finds suspicious.
Its address goes into trusted traffic, with an expiry date if necessary. Its calls are not inspected any more; all the other traffic is still inspected.
The back office is only accessible from our offices
Your admin area (/wp-login.php, /admin) is open to the whole Internet, but only a few people must access it.
An IP group “Head office” and a group “Management”, then a path rule in restricted access: everyone outside these addresses gets a 403 page, and the rest of the site stays open.
A writer can no longer save an article
The text of an article contains HTML code or a technical extract, and the WAF takes it for an attack.
The radiography of the request shows the field and the fragment that cause the block. The correction targets only this field, or only this path: the rest of the site keeps its full protection. For PrestaShop and Magento, the back-office path is declared: the Kokiris rulesets recognize the admin area only under this path.
Your web agency corrects its false positives, and nothing else
Your agency must read the logs and correct the blocks of its forms, but it must not change the bans, the blocked countries or the accounts.
An account with the Custom profile. In its permission grid: Dashboard and Logs in Read, False positives in Read and Write. Its menus show only these pages. For a script, an API key follows the same grid, and never goes above the rights of the person who creates it.
An attack campaign comes from one country
The dashboard shows thousands of blocks from one region, on a site that sells only in France.
The threat radar shows the campaign clearly. A geographic rule, first in detection only, then in blocking, cuts the traffic of this country for your sites.
On a Saturday evening, the checkout stops working
A recent change blocks one step of the payment. Each minute costs sales.
One click on “Emergency stop” puts all sites in detection only: the traffic gets through, everything stays logged, and you look for the cause calmly. A second click puts each site back in its mode.
“What happened last night?”
The dashboard shows a peak of blocks at 3 a.m., and you want to understand without reading hundreds of log lines.
The AI assistant summarizes the activity in English: who attacked, what was targeted, which rule reacted. Addresses, domain names and e-mail addresses are pseudonymized before they leave the server, and no cookie or password is sent.