Purpose * Minimize attack surface at the perimeter and web server before application code runs * Default-deny invalid or abusive traffic, and log for investigation Defense layers Edge perimeter filtering * Block traffic by country or region to reduce bot and scanner traffic before it reaches the site IP and domain restrictions * Block

Purpose * Admit only validated inputs and execute database operations safely * Reduce risk of injection, traversal, and session abuse Defense layers Input canonicalization and sanitization * Remove directory traversal tokens and null bytes * Normalize percent-encoding * Strip disallowed characters * Collapse repeated separators and whitespace Query-parameter allow-list and validation * Process only expected keys * Apply