Tuning the WAF without blocking customers
Score thresholds, exceptions, and how we test managed rules.
Managed rules assign an anomaly score. The default action at 50 is log; at 80 it is block. Most shoppers never see either. The people who do are usually scripts that POST JSON with a handful of known gadget strings.
Raise the threshold on a checkout path
$ gitflare waf exception add shop.example.com \
--path /checkout \
--action log \
--score-threshold 90
Inspect a blocked request
$ gitflare waf events shop.example.com --status blocked --limit 5 --json
Each event includes the rule id, the score, and a redacted snippet of the matched field. We never store full card numbers; the WAF runs after TLS is terminated and before the origin sees the body.
Test in staging
Point a staging hostname at the same Worker and set the exception to simulate. Traffic is scored but never blocked. Promote the same ruleset id to production when the false-positive rate is under 0.01% for a week.