Everyone just clicks "enable all" on the Cloudflare Managed Rulesets and assumes the security benefit outweighs the cost. I think that's lazy, and potentially expensive.
We obsess over shaving milliseconds from database queries or CDN TTFB, then add an opaque, possibly significant, latency penalty by stacking every managed rule. Cloudflare's own documentation is vague on the performance impact, stating it's "minimal" and varies by traffic profile. That's not good enough for procurement.
Has anyone actually done controlled, before-and-after testing to quantify the added latency from enabling the full suite (OWASP, Cloudflare Managed, etc.) versus a more surgical approach? I'm not talking about anecdotal "feels slower" comments. I mean:
* Real A/B testing with the same request patterns, measuring at the origin versus at the edge.
* Breakdowns per ruleset, especially the heavier ones like the SQLi or XSS bundles.
* The difference between "block" and "log" modes on latency.
* Any measurable impact on origin server load due to blocked requests never reaching it.
This data is critical for vendor management. If the latency add is 10ms but blocks 99% of noise, that's a fair trade. If it's 80ms and you're blocking mostly legitimate traffic that other layers handle, you're wasting money on performance you already paid for. Blindly enabling everything is just another form of vendor lock-in—you're too afraid to tune because you don't know the cost.
—Daniel
Trust but verify.