How to Tune F5 BIG-IP Advanced WAF
Run F5 BIG-IP Advanced WAF in Transparent mode, review staged matches and learning suggestions, and limit each exception to the URL, parameter, cookie or content profile that needs it.
How to Tune Google Cloud Armor WAF Rules
Tune Cloud Armor preconfigured WAF rules with preview traffic, versioned signatures, sensitivity levels, field exclusions and policy priority.
How to Tune Cloudflare WAF When Rule 949110 Blocks a Request
Trace a Cloudflare OWASP anomaly-score block to the rules that raised the score, then choose the right override or exception.
How to Tune Azure Application Gateway WAF
Start Azure Application Gateway WAF in Detection mode, find false positives in Log Analytics, narrow each exclusion and move into Prevention mode.
How to Tune AWS WAF with Count, Labels and Rule Priority
Use Count overrides, managed-rule labels and rule priority to fix AWS WAF false positives while keeping the rest of the managed rule group in force.
How to Tune Coraza on Caddy
Run Coraza and OWASP CRS on Caddy in DetectionOnly, read the audit log and limit each exclusion to the field and route that need it.
How to Tune Your WAF Without Turning It Off
A practical process for running a CRS-based or managed WAF in detection mode, finding repeatable false positives and writing narrow exceptions that survive real application traffic.
When and Why to Use a WAF: A Guide for WAF Sceptics
WAFs are neither useless nor a security force field. Here is what they are good at, where they fail, and when putting one in front of an application makes sense.
Your Application Needs a WAF. Just Not for the Reason You Think
A web application firewall will not fix insecure code. It can still give applications a valuable layer of protection when bugs, bots and attacks reach the front door.
Everyone Says a WAF Is Useless. Are They Right?
Ten good reasons not to trust a web application firewall—and why most of them are arguments for using one properly, not going without one.