Type
Product improvement
Description
Please Run Rate Limiting Last in Your WAF
Benefit
Presently your managed rules run after rate limiting, but this is is inefficient, as a bad request is blocked by your rules immediately, whereas rate limiting requires multiple hits for an IP to be blocked or passed on to your managed rules. In the case of a DDoS, the extra hits from each IP could take a server offline (or at least slow it down) even if the requests are eventually blocked. At present I am working around this by creating custom rules that match your most commonly triggered managed rules, but this is also inefficient, and there doesn’t seem to be any way to replicate your “Anomaly:Header:Accept - Missing or Empty” rule, for example (if there is a way to do this with a custom rule please let me know how!)