Regex Threat Protection policy

Updated 22 July 2026

The regex-threat-protection policy extracts information from a request, such as headers, path, query parameters, and body payload. It evaluates that content against pre-defined regular expressions. If any content matches the specified regular expression, the policy treats the request as a threat and rejects it with a 400 BAD REQUEST.

Timing

On Request	On Request Content
X	X

Configuration

Property	Required	Description	Type	Default
regex	yes	Use regex to detect malicious injections. You can enable this regular expression on headers, path and body, or add multiple regex threat protection policies with a different regex.	string
caseSensitive	no	Perform case-sensitive matching. Note: Use with caution. Enabling case sensitive matching may miss some patterns such as DrOp TaBlE.	boolean	false
checkHeaders	no	Evaluate regex on request headers.	boolean	true
checkPath	no	Evaluate regex on request path and query parameters.	boolean	true
checkBody	no	Evaluate regex on request body content.	boolean	true

Errors

HTTP status code

Code	Message
400	Applies to matching request headers, matching request path or query parameters, matching request bod.