WAF blocking legitimate traffic: find the rule in the events log

WAF false positives

Legitimate traffic getting blocked (or challenged) is a rule problem, not a WAF problem. The fix is surgical.

Find the rule

The Security events log records every action the WAF took and which rule took it. Filter by the affected client IP or path, find the block event, and read the rule name. This takes minutes and ends all speculation about "is it the WAF".

Fix options, in order

1. Skip rule above the blocker: if the traffic is known-legitimate (health checks, partner webhooks, your office IPs), add a Skip rule for that pattern placed before the blocking rule. Order matters: the skip must evaluate first.
2. Tune the rule: narrow the expression so the legitimate pattern no longer matches (exclude the path, the user agent, the ASN).
3. Challenge instead of block: for uncertain traffic, Managed Challenge is the middle ground while you gather data.

What not to do

• Do not disable the managed ruleset or the whole WAF because one rule misfires. You lose all protection to fix one pattern.
• Do not allowlist by IP and forget it: stale allows accumulate. Date them and review.

Checklist

• Events log first: name the rule before changing anything.
• Skip rules go above the rules they exempt.
• Re-test with the exact request that was blocked, and confirm the log shows the skip firing.

Verified against the live WAF Custom Rules doc: rules evaluated in order, Block stops evaluation, Skip action exempts traffic from security features. Ref: https://developers.cloudflare.com/waf/custom-rules/