# Defense Settings

## Operating Mode

There are 3 operating modes for WAF rules, namely blocking mode, alert mode, and pass mode:

- **Blocking mode**: Will intercept or allow according to the defense rules
- **Alert mode**: Will generate attack logs according to the defense rules, but will not intercept attack requests
- **Pass mode**: Will not generate any attack logs, all access requests will be allowed

You can change the operating mode at the top of the WAF rules and information security defense rules tabs, or you can click [Edit] next to the corresponding domain in the [domain management](/docs/uewaf/features/domain/domain_set) interface to modify the operating mode in the pop-up window.

<!-- image-todo -->

!> Note:  
The CC attack defense and blacklist and whitelist functions are controlled by their own independent switches under **blocking mode** and **alert mode**, and functions such as WAF rules, CC rules, black and white lists are invalid under pass mode.

## Rule Priority

The priority between the blacklist and whitelist, CC rules, and WAF rules is (from left to right, the priority decreases):

**Global Whitelist > Domain Whitelist > Global Blacklist > Domain Blacklist > Regional IP Blocking > CC Rules > Custom WAF Rules > Default WAF Rules > Information Security Defense Rules**

There are independent priorities between WAF rules, which can be freely adjusted, but the priority of default WAF rules is always lower than that of custom rules and cannot be adjusted.