Note: Bunny Shield's WAF variables/operators/transformations follow ModSecurity-style conventions and RX is
backed by a .NET regex engine (it auto-switches to a non-backtracking engine for complex patterns to block ReDoS).
That's very close to — but not identical to — the JavaScript regex used in this page's live tester: everyday
literals, classes, quantifiers, anchors and alternation behave the same, but backreferences and some lookbehind
forms aren't available once the non-backtracking engine kicks in. Bunny's docs also don't state whether RX
requires full-string anchoring or matches anywhere in the value by default — this tool leaves that to you via the
anchor checkboxes above rather than assuming. Verify anything security-critical against a real rule in your dashboard.
RX performs regular-expression matching. Regex metacharacters ( . * + ? ^ $ ( ) [ ] { } | \ )
are escaped automatically when you build a pattern from a plain value; switch to "Custom regex" to write raw regex yourself.
See also: Bunny Shield WAF: Fast, Flexible, and RegEx-Ready.