Why a WAF rule that looks right still blocks legitimate traffic

Why a WAF rule that looks right still blocks legitimate traffic

A common expression: block requests where the user agent is empty. Sounds sane. In practice it takes down webhook deliveries from payment providers, some mobile SDKs and half the uptime monitors.

Where the false positives come from:
— Operators. "contains" versus "eq" versus "matches" behave differently, and a regex without anchors matches far more than you intended.
— Field choice. Filtering on the full URI catches query strings you didn't consider. Filtering on the path only is usually what you meant.
— Missing exceptions. Every strict rule needs a skip rule above it for known good sources: your own office, payment callbacks, search engine verification.

How to debug: open Security Events, filter by the rule ID, and look at the actual matched requests. Ten minutes there beats an hour of guessing. If the sample contains anything with a referer from your own domain, the rule is too wide.