The Policy menu configures policies and protection profiles.

You can configure most protection features and traffic modification at any time. However, FortiWeb does not apply most features until you include them in a policy that governs traffic (either directly or indirectly, via protection profiles).