WAF policies
Testing policies
Safe rollout workflow from Test/Detect to Enforce.
Goal
Ship WAF coverage without surprising production users.
Recommended workflow
- Author the rule with a tight path/method scope.
- Set mode to Detect or Simulate.
- Publish and generate realistic traffic (or staging replay).
- Review Analytics → Security events.
- Adjust expression to cut false positives.
- Switch to Enforce and monitor again.
- Keep a rollback version handy (Config → Rollback).
Using Test mode
Test rules are skipped on the live path—use them for offline/lab validation in the control plane tooling when available, not as a shadow mode for production traffic.
Verify
- Detect: events without elevated 4xx/5xx from WAF blocks.
- Enforce: only intended abuse is denied; error budgets stay healthy.