{"templateId":"markdown","sharedDataIds":{},"props":{"metadata":{"markdoc":{"tagList":["img"]},"type":"markdown"},"seo":{"title":"Setting up a Reverse Proxy in Imperva Cloud WAF","description":"Integrate and automate your content creation process with Foleon's powerful API.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"setting-up-a-reverse-proxy-in-imperva-cloud-waf","__idx":0},"children":["Setting up a Reverse Proxy in Imperva Cloud WAF"]},{"$$mdtype":"Tag","name":"div","attributes":{"style":{"padding":"1em","backgroundColor":"#ffcdcd","borderLeft":"5px solid #ffbaba","margin":"1em 0"}},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["⚠️ Warning:"]}," This guide needs to be tested and might contain inaccuracies depending on your setup. Please contact our support team if you experience any issues.\n"]},{"$$mdtype":"Tag","name":"div","attributes":{"style":{"padding":"1em","backgroundColor":"#fff3cd","borderLeft":"5px solid #ffeeba","margin":"1em 0"}},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["⚠️ Warning:"]}," This guide provides a general overview of the configuration process. Technical requirements vary by environment; always consult your internal IT or security teams before applying these settings. If you would like to complete this setup with a Foleon technical expert, please contact ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Foleon Support"]}," or your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Customer Success Manager."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-it-works","__idx":1},"children":["How it works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In reverse-proxy mode ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["you terminate TLS at Imperva with your own certificate"]},", and Imperva forwards requests to Foleon's edge (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s1.foleon.com"]},"). Foleon does ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["not"]}," hold a certificate for your domain, so how Imperva talks to the origin matters:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Imperva forwards the visitor's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}," header to the origin by default. Left alone, the origin TLS handshake is attempted for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["your-domain.com"]},", which Foleon's load balancer has no certificate for, and the request fails with a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["502"]}]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The fix: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["rewrite the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}," header to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s1.foleon.com"]}]}," before the request leaves Imperva, and tell Foleon which document to serve by sending your domain in the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Forwarded-Host"]}]}," header instead."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Foleon's gateway resolves the document from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Forwarded-Host"]}," (falling back to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}," only when ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Forwarded-Host"]}," is absent)."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Unlike CloudFront, Imperva has no \"forward everything except ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]},"\" switch — both header changes are done with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delivery Rules"]},", and both must be in place before you point DNS."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"1-adding-your-domain-into-foleon","__idx":2},"children":["1. Adding your domain into Foleon"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Login to Foleon"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to \"Domains\" in the Admin Console (or your workspace)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use HTTPS protocol to ensure end-to-end encryption"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click \"Create new Domain\""]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Fill in the domain"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click the checkbox for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Reverse proxy"]}," — this tells Foleon to route the domain by the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Forwarded-Host"]}," header and not to provision a certificate for it on Foleon's side"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click \"Save\""]}]},{"$$mdtype":"Tag","name":"Image","attributes":{"src":"/assets/domains.3b86bffae10ff009a14daf55021f0e6bac24bc78dff6fe695f1202d24a89f377.9c1bb791.gif","alt":"domains.gif","framed":false,"withLightbox":true,"width":"","height":""},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"2-add-the-site-in-imperva","__idx":3},"children":["2. Add the site in Imperva"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the Imperva Cloud Application Security console, add a new ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["site"]}," for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["your-domain.com"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Imperva will give you a site CNAME (and a set of A records for apex domains). ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Do not change your DNS yet"]}," — finish the origin and rule configuration first, or your visitors will hit a broken origin."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Leave the site in SNI-only mode (the default for new sites)."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"3-configure-the-origin-data-center","__idx":4},"children":["3. Configure the origin data center"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create a data center for Foleon and add a single origin server:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Origin server:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s1.foleon.com"]}," (EU) or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s1.us.foleon.com"]}," (US)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Protocol / port:"]}," HTTPS, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["443"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SSL to origin:"]}," enabled"]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["hostname"]},", not an IP address. Foleon's edge sits behind a load balancer and its IPs change without notice — a pinned IP will break silently. If your account only accepts IP-based origins, contact Foleon Support before going further."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Do not set an origin path. Imperva passes the visitor path through as-is, which is what Foleon expects; prepending a path produces a doubled URL (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/hub/hub/..."]},")."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"4-rewrite-the-host-header","__idx":5},"children":["4. Rewrite the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}," header"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Add a Delivery Rule:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Action:"]}," Rewrite Header"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Header name:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Value:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s1.foleon.com"]}," (or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s1.us.foleon.com"]},")"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is the rule that keeps the origin TLS handshake alive. Without it you get a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["502"]}," on every request."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"5-add-the-x-forwarded-host-header","__idx":6},"children":["5. Add the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Forwarded-Host"]}," header"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Add a second Delivery Rule:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Action:"]}," Rewrite Header"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Header name:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Forwarded-Host"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Value:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["your-domain.com"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Because an Imperva site is scoped to one domain, a static value is fine here — there is no need for the dynamic host-copying you would use on a shared CloudFront distribution."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Do not"]}," add an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Forwarded-Proto"]}," header. The origin load balancer already sets it on the HTTPS hop, and a duplicate value will corrupt the URL the gateway builds."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Make sure both rules are ordered so they run ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["before"]}," any forwarding rule."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"6-scope-it-to-a-base-path-optional","__idx":7},"children":["6. Scope it to a base path (optional)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Skip this if the whole domain serves Foleon content."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If only a subfolder should reach Foleon (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/publications/"]},") while the rest of the site stays on your existing origin:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Add a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Forward to Data Center"]}," rule filtered on the URL prefix, pointing at the Foleon data center from Step 3."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Add the same URL-prefix condition to the two header rules from Steps 4 and 5, so the rest of your site keeps its own ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}," untouched."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"7-certificate-and-dns","__idx":8},"children":["7. Certificate and DNS"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Let Imperva provision the certificate for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["your-domain.com"]},", or upload your own."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Once the certificate is active and the rules are saved, point DNS at Imperva: a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CNAME"]}," to your Imperva site CNAME, or the provided A records for a zone apex."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"8-caching","__idx":9},"children":["8. Caching"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Disable caching for the Foleon path. Foleon documents can be access-controlled or personalized (cookies / query tokens), and caching by URL alone could serve one visitor's content to another."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your documents are fully public and you want CDN caching, use a cache mode that honors the origin's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Cache-Control"]}," headers, and never include ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}," in the cache key."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"9-apply-a-domain-to-a-project","__idx":10},"children":["9. Apply a domain to a project"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Login to Foleon."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to project settings."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the newly created domain."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set up the base path / subfolder you want to use to publish your documents on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Make sure to publish a document in this project."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["TIP:"]}," You can set up multiple projects with the same base path, e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/en/guide/finance/"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/en/guide/legal/"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"verify","__idx":11},"children":["Verify"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before touching DNS, confirm the origin contract directly:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"curl -I https://s1.foleon.com/en/guides/ -H \"X-Forwarded-Host: your-domain.com\"\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A Foleon ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["404"]}," page means the origin side is sound. A ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["502"]}," or TLS error means the problem is upstream of Imperva."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After the DNS cutover, browse to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://your-domain.com/en/guides/"]},". A Foleon ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["404"]}," confirms Imperva is talking to Foleon correctly; the content loads once Step 9 is complete."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":12},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Symptom"},"children":["Symptom"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Cause"},"children":["Cause"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Fix"},"children":["Fix"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["502"]}]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The visitor ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}," is still being forwarded, so the origin TLS handshake is attempted for a name Foleon has no certificate for"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Confirm the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]}," rewrite rule from Step 4 exists, is enabled, and matches the requested path"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Foleon 404 page"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Reached the gateway, but no document matches the host + path"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Check the domain is assigned to a project, the base path matches your URL, and a document is published"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Infinite redirect loop"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Origin configured as HTTP; the gateway redirects HTTP→HTTPS"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Set the origin data center to HTTPS on port 443"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["400 / blank page"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Forwarded-Proto"]}," set manually and duplicated by the LB, corrupting the built URL"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Remove any ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Forwarded-Proto"]}," rule"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Origin unreachable after weeks of working"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Origin pinned to an IP address that has since changed"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Switch the origin server to the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s1.foleon.com"]}," hostname"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]}]},"headings":[{"value":"Setting up a Reverse Proxy in Imperva Cloud WAF","id":"setting-up-a-reverse-proxy-in-imperva-cloud-waf","depth":1},{"value":"How it works","id":"how-it-works","depth":2},{"value":"1. Adding your domain into Foleon","id":"1-adding-your-domain-into-foleon","depth":2},{"value":"2. Add the site in Imperva","id":"2-add-the-site-in-imperva","depth":2},{"value":"3. Configure the origin data center","id":"3-configure-the-origin-data-center","depth":2},{"value":"4. Rewrite the Host header","id":"4-rewrite-the-host-header","depth":2},{"value":"5. Add the X-Forwarded-Host header","id":"5-add-the-x-forwarded-host-header","depth":2},{"value":"6. Scope it to a base path (optional)","id":"6-scope-it-to-a-base-path-optional","depth":2},{"value":"7. Certificate and DNS","id":"7-certificate-and-dns","depth":2},{"value":"8. Caching","id":"8-caching","depth":2},{"value":"9. Apply a domain to a project","id":"9-apply-a-domain-to-a-project","depth":2},{"value":"Verify","id":"verify","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2}],"frontmatter":{"seo":{"title":"Setting up a Reverse Proxy in Imperva Cloud WAF"}},"lastModified":"2026-08-03T13:31:18.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/reverse_proxy/imperva","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}