Add the first site

Point CheeseWAF at a domain and an upstream, then pick paranoia level 3.

In the console open Sites → New site.

Enter the hostname clients already use, for example app.example.com. CheeseWAF matches sites[].domains.

Enter the origin address, for example 10.0.0.10:8000. More than one upstream uses the site loadbalance policy (round_robin by default).

Use level 3 for a first production site. Level 3 blocks isolated attack values and allows embedded hits for later ALAP review.

Save the site. The process reloads the site list without a full restart.

Point DNS or the local hosts file at the CheeseWAF data-plane address. Confirm the origin still answers through CheeseWAF before you raise the level.