Hot take: Their marketing says 'set and forget,' but you'll be tweaking rules weekly.

Hey everyone, I saw this thread topic and it really hit home. I'm still pretty new to this, but I've been using Cloudflare's free WAF for my small projects.

Their docs make it sound like you turn it on and you're done. But I feel like I'm constantly checking the firewall events and adding new rules. Just last week, I had to make a rule to block some weird bot traffic that was slipping through. It wasn't hard, but it's definitely not "set and forget" for me.

Is this normal? For those more experienced, how often do you actually tweak your WAF settings? Do you start with a strict setup and loosen it, or the other way around? Trying to figure out the best workflow.