# Troubleshooting

> What to do when the WAF blocks a legitimate request, a WordPress login, a large upload or a partner, and how to find out which rule did it.

## A legitimate request was blocked

1. Find the request in [security events](https://developers.openwaf.dev/analytics/security-events/): filter by IP, path or status 403. The event shows the `rule_name` and `rule_id`.
2. If it's a WAF rule (a CRS id such as `942100` or an OpenWAF id between 10000 and 19999), add a [WAF exception](https://developers.openwaf.dev/waf/waf-exceptions/) for that `rule_id` on that path.
3. If it's a shield (1001–1008), add an exception with the shield's id; a `rule_id` 0 exception doesn't switch shields off.
4. While you investigate, you can put only that name in log-only mode with [per-name settings](https://developers.openwaf.dev/rules/per-name-settings/).

## WordPress admin or login is blocked

OpenWAF rule 10002 blocks `/wp-login.php`, `/wp-admin`, `/wp-includes`, `/wp-content/uploads` and `/xmlrpc.php` on sites that don't declare WordPress. Set `stack=wordpress` for that name (**Security → Firewall → Application → WordPress**). `/xmlrpc.php` stays blocked by the WordPress shield (1001); add an exception for 1001 on `/xmlrpc.php` if you really need it.

## Large uploads or JSON bodies get 403 or 413

- `413` before anything else: the body is larger than `max_body_mb`. Raise it for that name.
- `403` with rule `10101`: the WAF inspects up to 1 MiB of a request body and blocks bodies whose content it couldn't inspect. If the path legitimately receives larger bodies, add a WAF exception for `rule_id` `10101` on that exact path: the body is then forwarded with only its first part inspected.
- `413` from a shield on a JSON, GraphQL or AI endpoint body larger than 1 MiB: the same rule `10101` exception on that path lets it through.
- `403` with rule `10102`: the request has more than 4,000 arguments, so it couldn't be inspected completely.

## A partner or monitoring service is blocked

If the event is `Feed Block`, the address is on a [threat feed](https://developers.openwaf.dev/waf/threat-feeds/): add an IP `allow` rule for it. If it's `Geo Block`, review your country rules. An `allow` rule doesn't skip rate limits or the WAF.

## Users get 429

Look for `rate_rule:<id>`, `Advanced Rate Limit` or `Site Rate Limit` in the events. Visitors behind one network share an IP: raise the limit, switch the rule to `log` to measure, or key it by `body_field` or `cookie` instead. See [Rate limiting](https://developers.openwaf.dev/waf/rate-limiting/#per-node-divisor).

## My application can't read a cookie

The edge adds `HttpOnly`, `Secure` and `SameSite=Lax` to cookies that lack them. See [Response headers](https://developers.openwaf.dev/waf/responses/#response-headers).

## Changes don't seem to apply

Every change is a new version that each edge node applies within about a minute. Check **Changes → Propagation** or `openwaf-cloud ctl zones propagation example.com`, and the name's [effective configuration](https://developers.openwaf.dev/rules/effective-config/).