01 / DECISION
When this primitive earns a place
Use managed rules for known attack classes and narrow custom expressions for application-specific invariants.
02 / ARCHITECTURE
Build the smallest defensible path
Start in log or challenge mode, inspect matched traffic, constrain hostname and path, add documented exceptions, then promote with a rollback owner.
- 01Name the contract
Use managed rules for known attack classes and narrow custom expressions for application-specific invariants.
- 02Add one primitive
Start in log or challenge mode, inspect matched traffic, constrain hostname and path, add documented exceptions, then promote with a rollback owner.
- 03Capture failure evidence
Measure matched requests and false positives, replay approved test cases, and verify that bypasses are no broader than necessary.
03 / REPRODUCE
Evidence before confidence
Measure matched requests and false positives, replay approved test cases, and verify that bypasses are no broader than necessary.
curl -i "https://example.com/test-path?input=known-safe-probe"04 / BOUNDARY
The production boundary
A broad block rule can become an outage. WAF does not replace authentication, authorization, input validation, or secure code.
05 / FIRST-PARTY SOURCES
Keep first-party sources authoritative
Product behavior, limits, pricing, and availability can change. Re-check these sources before acting.