Technical Tip: Configuring custom FortiWeb block pages using non-Latin characters

FortiWeb customizes block pages through replacement messages. The general procedure for creating and applying replacement messages is documented in the FortiWeb Administration Guide. For standard configuration steps, follow the instructions in Customizing error and authentication pages (Replacement Messages) in the FortiWeb documentation.

When using non-Latin languages, such as Arabic, additional HTML considerations are required to ensure correct rendering. 

Additional steps for non-Latin block pages:

Follow the instructions in Customizing error and authentication pages (Replacement Messages) to create or edit a replacement message. While doing so, locate the available sections in the replacement message editor, such as:

• Captcha Enforcement.
• Security.
• Site Publish Authentication.

If the block page is intended for security violations, expand Security and select Attack Block Page to edit the corresponding HTML template. When editing the HTML content, paste the custom non-Latin page content into the code pane and confirm that the preview pane updates accordingly. The HTML template must include a UTF-8 character set declaration to ensure that non-Latin characters render correctly in the browser. For example:

<meta http-equiv='Content-Type' content='text/html; charset=utf-8'>

Binding the custom replacement message to a server policy:

After creating the replacement message, bind it to the appropriate server policy as described in the FortiWeb Administration Guide. Ensure that the replacement message is selected under the Security Configuration section of the server policy so that it is applied when a blocking action is triggered.

Expected behavior:

After the replacement message is applied, any request blocked by the server policy using a blocking action such as Alert & Deny or Period Block returns the custom Arabic block page. The following macros can be included in the HTML to display request and event details:

• %%URL%%
• %%SOURCE_IP%%
• %%EVENT_ID%%
• %%MSG_ID%%

Notes:

• The example HTML code must include a UTF-8 meta declaration to ensure proper rendering of Arabic or other non-Latin characters.
• Message details such as Message ID are displayed only when the corresponding macros are explicitly included in the HTML template.

Related document:

Customizing error and authentication pages (replacement messages)