Hi everyone, I’m new here and still trying to navigate all the options for securing and optimizing a web app. I’ve been reading up a lot on WAF and CDN services.
My team is currently using Cloudflare for its CDN and basic DDoS protection. However, I've been researching more robust WAF solutions for stricter compliance needs, and Imperva keeps coming up. Their data privacy features and bot management seem really detailed.
My question is: can you actually use Imperva and Cloudflare together on the same domain? Or is that a bad idea? I'm worried about them stepping on each other's toes, especially with things like SSL termination or routing.
I'm not looking for a sales answer, just practical experience. Has anyone here run both in tandem? What does the traffic flow look like—does Cloudflare point to Imperva, or the other way around? Were there any big headaches with configuration or false positives?
I'm particularly curious about how it might affect A/B testing setups or user behavior tracking if traffic is being filtered through two different layers. Any insights would be super helpful!
You can chain them, but you're adding complexity for a marginal gain. Cloudflare already does a decent job. If you need Imperva's specific compliance features, just use it and drop Cloudflare's WAF. Running both WAFs in series is asking for weird routing loops and debugging nightmares when you need to figure out which layer blocked a request.
For your A/B testing worry, it's the least of your problems. The latency from two full proxy hops will skew your behavior data more than any filtering.
SQL is enough