diff --git a/static/public/__view.html b/static/public/__view.html
index 1690cd7..c29f08e 100644
--- a/static/public/__view.html
+++ b/static/public/__view.html
@@ -47,6 +47,7 @@
         <a href="https://beian.miit.gov.cn/" target="_blank" rel="noopener">蜀ICP备2024107064号-2</a>
     </footer>
 
+    <script src="js/validation.js"></script>
     <script src="js/view.js"></script>
 </body>
 </html>
diff --git a/static/public/js/dnfs.js b/static/public/js/dnfs.js
index 1282fe6..b5e4e91 100644
--- a/static/public/js/dnfs.js
+++ b/static/public/js/dnfs.js
@@ -19,6 +19,11 @@ async function getNode(id) {
 		});
 
 		const responseText = await res.text();
+		// WAF 拦截：弹提示并中止，不能落入 catch（其会误跳登录页）
+		if (window.WafTip && WafTip.isBlocked(res, responseText)) {
+			alert(WafTip.MESSAGE);
+			return;
+		}
 		let result;
 
 		try {
@@ -78,6 +83,7 @@ async function addNode(pid, title, content) {
 		});
 
 		const responseText = await res.text();
+		if (window.WafTip && WafTip.isBlocked(res, responseText)) throw new Error(WafTip.MESSAGE);
 		let result;
 
 		try {
@@ -137,6 +143,7 @@ async function deleteNode(id) {
 		});
 
 		const responseText = await res.text();
+		if (window.WafTip && WafTip.isBlocked(res, responseText)) throw new Error(WafTip.MESSAGE);
 		let result;
 
 		try {
@@ -188,6 +195,7 @@ async function deleteChild(id) {
 		});
 
 		const responseText = await res.text();
+		if (window.WafTip && WafTip.isBlocked(res, responseText)) throw new Error(WafTip.MESSAGE);
 		let result;
 
 		try {
@@ -246,6 +254,7 @@ async function updateNode(id, pid, title, content) {
 		});
 
 		const responseText = await res.text();
+		if (window.WafTip && WafTip.isBlocked(res, responseText)) throw new Error(WafTip.MESSAGE);
 		let result;
 
 		try {
@@ -301,6 +310,7 @@ async function moveNode(id, pid, title, content) {
 		});
 
 		const responseText = await res.text();
+		if (window.WafTip && WafTip.isBlocked(res, responseText)) throw new Error(WafTip.MESSAGE);
 		let result;
 
 		try {
diff --git a/static/public/js/login.js b/static/public/js/login.js
index fc3b7dc..1012ff6 100644
--- a/static/public/js/login.js
+++ b/static/public/js/login.js
@@ -22,6 +22,11 @@ async function refreshCaptcha() {
 	captchaToken = '';
 	try {
 		const res = await fetch('/captcha/image', { cache: 'no-store' });
+		if (res.status === 403) {	// WAF 拦截：body 非图片，提示后待用户点击重试
+			captchaImg.removeAttribute('src');
+			captchaImg.alt = '验证码加载被安全规则拦截，点击重试';
+			return;
+		}
 		if (!res.ok) throw new Error('captcha load failed');
 		captchaToken = res.headers.get('X-Captcha-Token') || '';
 		const blob = await res.blob();
@@ -126,6 +131,7 @@ form.addEventListener('submit', async function(e) {
 			body: jsonBody
 		});
 		const responseText = await res.text();
+		if (window.WafTip && WafTip.isBlocked(res, responseText)) throw new Error(WafTip.MESSAGE);
 		let result;
 		try { result = JSON.parse(responseText); } catch { throw new Error('服务器响应格式异常'); }
 		if (!res.ok) throw new Error(result.message || '登录失败');
diff --git a/static/public/js/register.js b/static/public/js/register.js
index 86380f0..298a93c 100644
--- a/static/public/js/register.js
+++ b/static/public/js/register.js
@@ -143,6 +143,7 @@ getCodeButton.addEventListener('click', async function () {
 		});
 		httpStatus = res.status;
 		const responseText = await res.text();
+		if (window.WafTip && WafTip.isBlocked(res, responseText)) throw new Error(WafTip.MESSAGE);
 		let result;
 		try { result = JSON.parse(responseText); } catch { throw new Error('服务器响应格式异常'); }
 		if (!res.ok || !result.success) throw new Error(result.message || '验证码发送失败');
@@ -190,6 +191,7 @@ form.addEventListener('submit', async function (e) {
 		});
 
 		const responseText = await res.text();
+		if (window.WafTip && WafTip.isBlocked(res, responseText)) throw new Error(WafTip.MESSAGE);
 		let result;
 
 		try {
diff --git a/static/public/js/validation.js b/static/public/js/validation.js
index 03ecc5f..1779c61 100644
--- a/static/public/js/validation.js
+++ b/static/public/js/validation.js
@@ -68,3 +68,15 @@
 
 	window.FormValidators = { username, password, email };
 }());
+
+/* WAF 拦截识别：waf 命中规则时返回 403 + 纯文本 "blocked by WAF"
+ * （见 waf/internal/proxy/proxy.go block()）；gateway 的 403（Target-Url
+ * 白名单拒绝）body 为 JSON 错误消息，不含此特征，不会误判。 */
+window.WafTip = {
+	MESSAGE: '请求被 WAF 安全规则拦截，请检查输入内容',
+	isBlocked(res, responseText) {
+		return res.status === 403
+			&& typeof responseText === 'string'
+			&& responseText.indexOf('blocked by WAF') !== -1;
+	}
+};
diff --git a/static/public/js/view.js b/static/public/js/view.js
index f42723e..0c06be8 100644
--- a/static/public/js/view.js
+++ b/static/public/js/view.js
@@ -138,7 +138,9 @@ async function loadData() {
     try {
         const url = `/api/filelist?path=${encodeURIComponent(currentPath)}`;
         const res = await fetch(url);
-        const data = await res.json();
+        const responseText = await res.text();
+        if (window.WafTip && WafTip.isBlocked(res, responseText)) throw new Error(WafTip.MESSAGE);
+        const data = JSON.parse(responseText);
         if (data.success) {
             items = data.items || [];
             render();