# WAF configuration and management — Cloudflare, Imperva, Sucuri, AWS | RootCore LLC

> A Web Application Firewall on default settings protects almost nothing. Custom rule sets, OWASP Top 10 coverage, false positive handling and a monthly report.

Page: https://cyber-security.rootcr.com/en/waf-configuration/
Updated: 2026-08-20

---

# WAF configuration and management

> **In short:** A Web Application Firewall sits between your web application and the internet and filters out attack patterns — but only if it is configured properly. The default rule set either lets real attacks through or blocks your own customers. RootCore designs, tunes and maintains custom rule sets on Cloudflare, Imperva, Sucuri and AWS WAF.

## Why is switching a WAF on not enough?

Because the WAF cannot know by itself what normal traffic looks like in your application. The stock rule set is tuned for the general case: it catches what is certainly an attack on every site, and misses what is suspicious in yours.

Two failure modes follow, and one of them is always present:

- **Too permissive:** the attack that matters goes through. The operator is calm because “we have a WAF”, while the protection catches little more than the noisiest scanners.
- **Too strict:** the rule filters out your own customers. It surfaces in support — “I cannot place my order” — and is usually “solved” by turning the WAF off.

A usable configuration lives between the two, and it is not a one-time setting: traffic changes, rule sets get updated, and false positives have to be measured back.

## What exactly do we do?

- Learning the application: which routes are public, where login, forms, file upload and APIs are.
- Designing a custom rule set on top of the stock one — stricter on risky routes, permissive for everyday traffic.
- OWASP Top 10 coverage: SQL injection, XSS, CSRF, remote code execution, broken access control.
- Rate limiting and bot handling: separate limits for login, cart, search and API endpoints.
- Geo and IP reputation filtering where it makes business sense.
- False positive monitoring: regular review of blocked requests so that we do not catch buyers.
- A monthly report: what passed, what was blocked, what is worth adjusting.

## Which platforms do we work on?

| Platform | Good for | Typical ground |
|---|---|---|
| Cloudflare | Custom rules, Managed Ruleset tuning, Workers integration | Most websites and shops |
| Imperva | Enterprise rule sets, DDoS protection, API security layer | High-traffic, complex systems |
| Sucuri | CMS-specific protection, malware cleanup, virtual patching | WordPress and other CMS |
| AWS WAF | Cloud-native rule groups, ALB/CloudFront integration | Applications running in AWS |

If you already have a WAF subscription, we configure that one — you do not need to switch platforms to get sensible protection.

## When do you not need us?

If you run a simple static brochure site with no forms and no login, the money spent on a WAF is better spent on security headers, updates and backups. We tend to say so after the assessment — and the assessment is free even when the answer is no.

## Frequently asked questions

### Does a WAF slow the site down?

Not noticeably in practice. Rule evaluation is in the millisecond range, and the platforms usually come with a CDN, which tends to speed things up. What does slow a site down is a badly written custom rule — which is why we measure before and after rollout.

### What if the WAF locks out my own customer?

That is a false positive, and we plan for it. At rollout part of the rule set runs in monitoring mode, and the switch to blocking is based on measurement. Later false positives come up in the monthly review; fixing one is a matter of minutes.

### Does a WAF protect against stolen passwords?

No. A WAF filters requests, it does not do authentication. Password and access management belong to [server security](/en/server-security/) and to the application; the most a WAF can do here is throttle login attempts.

### Is a free Cloudflare plan worth anything?

Yes, but with limits: the number of custom rules and detailed bot handling are tied to paid plans. After the assessment we tell you whether the free tier is enough for your traffic, or which step brings the most.