Take a look at the following attack on a Web Server using obstructed URL: How would you protect from these attacks?

Blocking all hex-encoded characters would break legitimate web traffic because percent-encoding is a standard and required part of the URI specification for many valid requests.

An IDS configured with rules to detect unusual Unicode or percent-encoded character sequences in HTTP requests can identify and alert on URL obfuscation attempts in real time. This approach catches evasion techniques that bypass naive string-matching filters, allowing security teams to investigate and block malicious traffic. It addresses the root behavior - encoding used to disguise attack payloads - rather than surface-level symptoms.

SSL authentication secures the transport layer and verifies identity, but it does not inspect or block malformed or obfuscated URL paths sent inside the encrypted session.

Active Scripts Detection at the firewall targets script execution attempts, not URL encoding obfuscation, so it would not detect or prevent this specific attack vector.