WAF blocking legitimate traffic: find the rule in the events log

TL;DR

Skip rule above the blocker: if the traffic is known-legitimate (health checks, partner webhooks, your office IPs), add a Skip rule for that pattern placed before the blocking rule. Challenge instead of block: for uncertain traffic, Managed Challenge is the middle ground while you gather data.

Steps

1. Legitimate traffic getting blocked (or challenged) is a rule problem, not a WAF problem. The fix is surgical.
2. Skip rule above the blocker: if the traffic is known-legitimate (health checks, partner webhooks, your office IPs), add a Skip rule for that pattern placed before the blocking rule. Order matters: the skip must evaluate first.
3. Tune the rule: narrow the expression so the legitimate pattern no longer matches (exclude the path, the user agent, the ASN).
4. Challenge instead of block: for uncertain traffic, Managed Challenge is the middle ground while you gather data.
5. - Do not disable the managed ruleset or the whole WAF because one rule misfires. You lose all protection to fix one pattern.

• Do not allowlist by IP and forget it: stale allows accumulate. Date them and review.

When to use

You are seeing this: Legitimate traffic getting blocked (or challenged) is a rule problem, not a WAF problem. Use this skill when you run into "WAF blocking legitimate traffic: find the rule in the events log".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified against the live WAF Custom Rules doc: rules evaluated in order, Block stops evaluation, Skip action exempts traffic from security features. Ref: https://developers.cloudflare.com/waf/custom-rules/