Work out waf rule impact instantly with clear inputs, formula shown and shareable results.
A WAF rule is judged on both sides of its confusion matrix at production scale. At 40 million requests a day, blocking 0.8 percent with a 4 percent false-positive rate silently rejects over 12,000 legitimate requests daily — which is why new rules should run in count-only mode first. The latency term matters too, since it applies to every request, not just the blocked ones.
WAF rule impact
blocked = requests x block rate; false blocks = blocked x false positive rate; aggregate latency = requests x per-request latency
It reveals what would have been blocked without breaking anything. Managed rule sets frequently match legitimate traffic in ways that are impossible to predict from the rule text.
Legitimate payloads containing SQL or script-like fragments — rich text editors, code snippets, search queries and base64 blobs are the classic offenders.