Troubleshooting

#A legitimate request was blocked

1. Find the request in security events: filter by IP, path or status 403. The event shows the rule_name and rule_id.
2. If it's a WAF rule (a CRS id such as 942100 or an OpenWAF id between 10000 and 19999), add a WAF exception for that rule_id on that path.
3. If it's a shield (1001–1008), add an exception with the shield's id; a rule_id 0 exception doesn't switch shields off.
4. While you investigate, you can put only that name in log-only mode with per-name settings.

#WordPress admin or login is blocked

OpenWAF rule 10002 blocks /wp-login.php, /wp-admin, /wp-includes, /wp-content/uploads and /xmlrpc.php on sites that don't declare WordPress. Set stack=wordpress for that name (Security → Firewall → Application → WordPress). /xmlrpc.php stays blocked by the WordPress shield (1001); add an exception for 1001 on /xmlrpc.php if you really need it.

#Large uploads or JSON bodies get 403 or 413

• 413 before anything else: the body is larger than max_body_mb. Raise it for that name.
• 403 with rule 10101: the WAF inspects up to 1 MiB of a request body and blocks bodies whose content it couldn't inspect. If the path legitimately receives larger bodies, add a WAF exception for rule_id 10101 on that exact path: the body is then forwarded with only its first part inspected.
• 413 from a shield on a JSON, GraphQL or AI endpoint body larger than 1 MiB: the same rule 10101 exception on that path lets it through.
• 403 with rule 10102: the request has more than 4,000 arguments, so it couldn't be inspected completely.

#A partner or monitoring service is blocked

If the event is Feed Block, the address is on a threat feed: add an IP allow rule for it. If it's Geo Block, review your country rules. An allow rule doesn't skip rate limits or the WAF.

#Users get 429

Look for rate_rule:<id>, Advanced Rate Limit or Site Rate Limit in the events. Visitors behind one network share an IP: raise the limit, switch the rule to log to measure, or key it by body_field or cookie instead. See Rate limiting.

#My application can't read a cookie

The edge adds HttpOnly, Secure and SameSite=Lax to cookies that lack them. See Response headers.

#Changes don't seem to apply

Every change is a new version that each edge node applies within about a minute. Check Changes → Propagation or openwaf-cloud ctl zones propagation example.com, and the name's effective configuration.