What It Costs When It Fails
A WAF in detection mode is a monitoring tool, not a security tool. It observes attacks without blocking them. The reason most WAFs stay in detection mode is that enabling blocking mode without proper tuning causes false positives that break legitimate functionality. The solution is not to avoid blocking mode. The solution is to tune the WAF properly before enabling it.
A Web Application Firewall sits between the internet and your application, inspecting incoming requests and blocking those that match known attack patterns. SQL injection, cross-site scripting, remote code execution, and path traversal attacks all have recognisable signatures. A properly configured WAF stops them before they reach your application code.
The word “properly” is doing significant work in that sentence. A WAF configured with default rules against a complex application will generate false positives. It will block legitimate requests. It will frustrate users and create support burden. The response to this is almost always to move the WAF to detection mode, which eliminates the false positives by eliminating the protection.
The Tuning Requirement
WAF tuning is the process of adjusting rule sets to match the specific traffic patterns of a specific application. It requires understanding what legitimate requests look like for your application, what attack patterns are relevant to your technology stack, and how to write rules that distinguish between the two. This is not a one-time task. Applications change. Attack patterns evolve. WAF rules require ongoing maintenance.
"Is your WAF running in blocking or detection mode, what is your false positive rate, and when were the rules last reviewed and updated?"
HostRoman deploys WAFs in blocking mode with custom rule sets tuned to each application. We maintain a false positive rate below 0.01% through application-specific rule tuning. Rule sets are reviewed monthly and updated within 24 hours of new threat intelligence. We do not deploy generic rule sets without application-specific validation.