Model WAF load on a reverse proxy: rule evaluations, CPU cores, TLS handshake utilisation, blocked traffic and false positives.
A core delivers 1000 milliseconds of CPU per second, so the core count is simply request rate times per-request inspection cost divided by 1000. Precision is the share of blocked requests that were genuinely malicious — at a 4% block rate and a 0.05% false positive rate, precision is high, but the absolute false positive count per hour is what your support desk experiences. A WAF that looks accurate in percentage terms can still generate tens of thousands of blocked legitimate requests per hour at scale, which is why teams disable blocking mode and lose the control entirely.
Reverse Proxy Security
false positives per hour = rps × false positive rate × 3600; cores = ceil(rps × CPU ms per request ÷ 1000).
false positives per hour = rps × false positive rate × 3600; cores = ceil(rps × CPU ms per request ÷ 1000). A core delivers 1000 milliseconds of CPU per second, so the core count is simply request rate times per-request inspection cost divided by 1000. Precision is the share of blocked requests that were genuinely malicious — at a 4% block rate and a 0.05% false positive rate, precision is high, but the absolute false positive count per hour is what your support desk experiences.
A WAF that looks accurate in percentage terms can still generate tens of thousands of blocked legitimate requests per hour at scale, which is why teams disable blocking mode and lose the control entirely.
This calculator takes 7 inputs: Requests per second, WAF rules evaluated per request, Inspection CPU time per request, TLS handshakes per second, TLS handshake capacity, Requests blocked by policy, False positive rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because it is 0.05% of everything, not of attacks. At 12,000 requests per second that is 6 blocked legitimate requests every second — over 21,000 an hour. Percentages hide absolute volume, so always convert to per-hour counts before agreeing a threshold with the application owners.