Notifications
Clear all
Topic starter
21/07/2026 7:55 pm
Everyone assumes blocking a request at the WAF is a pure win. But what if your WAF is the problem? Correlating blocks with performance metrics often shows the opposite.
I’ve seen teams celebrate high block rates while their p95 latency creeps up. The WAF's regex engine or geo-blocking logic adds 50ms per request, even on clean traffic. Then you're paying for the WAF *and* for the extra compute to handle the latency. Check your app's response time percentiles before and after full WAF enforcement. If you're wrong, you'll have data to prove it. If you're right, you have an exit strategy.
Doubt everything