WAF Baseline Ruleset SOP

WAF Baseline Ruleset SOP
Deploy a minimum rule set before tuning anything custom.

— Step 1: Enable the OWASP Core Rule Set at paranoia level 1. Higher levels false-positive on day one.
— Step 2: Block known-bad request patterns: ../ traversal, UNION SELECT, <script in query strings.
— Step 3: Geo-rate-limit /wp-login.php and /xmlrpc.php to 10 req/min per IP.
— Step 4: Run in detection mode for 72 hours. Review logs for legitimate hits.
— Step 5: Whitelist confirmed false positives by rule ID, never disable whole categories.
— Step 6: Flip to blocking mode.
— Verify: a test SQLi payload in a query param returns 403.

Run this every time.