Understand rule families
WAF custom rules block or challenge matching requests; rate limiting rules act after a request rate crosses a threshold; Single Redirects change the destination URL; Cache Rules change cache eligibility and behaviour. Use the rule family whose action matches the intended outcome.
Write a narrow expression
Match stable request properties such as hostname, path, method or a documented header. Parenthesise mixed conditions and avoid a broad expression that catches administrator, webhook, API or asset traffic. Record one matching and one non-matching test request before deployment.
Order matters
Rules in a phase are evaluated in order, and a terminating action can prevent later rules from running. Place specific exceptions before broader rules only when that interaction is intentional. Review neighbouring rules whenever a rule is moved.
Configure rate limiting
Choose the matching expression, counting characteristic, requests per period, mitigation action and duration from measured legitimate traffic. Protect sensitive endpoints such as login or API paths without applying the same threshold to unrelated static assets. Enforcement is distributed and is not an exact origin-side request counter.
Configure redirects
Use 301 only for a permanent move whose destination is proven; use 302 for a temporary change. Preserve query strings only when the destination expects them. Test loops, path handling, URL encoding and both HTTP and HTTPS entry points.
Configure caching
Confirm the hostname is proxied and the response is safe to share before making it cache-eligible. Never cache authenticated or personalised content without a deliberate cache key and privacy review. Remember that a custom cache key can change which purge method works.
Deploy and recover
Start disabled when the impact is uncertain, inspect the expression and action, then enable and verify security events or response headers. If legitimate traffic is affected, disable the specific rule first and restore its prior order. Replace emergency bypasses with the narrowest proven exception.
