Testing a rule safely: the staged rollout nobody does

Testing a rule safely: the staged rollout nobody does

Pushing a new WAF rule directly to production is how outages start. A staged approach costs an hour and prevents most of them.

Stage 1. Write the rule with action "log". Wait a full business day. Review the matched sample — not just the count, the actual requests.

Stage 2. Narrow the expression to only the hosts or paths you care about. Add exceptions for anything legitimate you saw in stage 1.

Stage 3. Switch to "managed challenge" and watch the challenge solve rate. Near 100% solved means humans are being challenged and the rule is too broad. Near 0% means you found bots.

Stage 4. Only now consider "block", and only if the challenge is being solved by nothing.

Bonus trick: use a request header you control, like a custom value sent from your own test browser, and add a skip rule for it. You can then hit every rule yourself without ever getting blocked during testing.