WAF Setup: ModSecurity, Cloudflare and AWS WAF

A WAF blocks application-layer attacks that a network firewall simply cannot see. SQL injection in a request parameter, XSS in the User-Agent header, path traversal in the URL — all of these pass through Security Groups and hit the application directly. A WAF operates at the HTTP level, analyzes the request body, and makes a decision before the request reaches the code. Every day, millions of requests pass through our WAF, and only a few trigger false positives.

WAF — a necessary barrier

Developers often rely solely on a WAF, postponing code fixes. But a WAF is not a panacea — it blocks known vectors but not logical vulnerabilities. Our experience shows that a properly configured WAF provides 90% coverage of the OWASP Top 10 with well-managed exceptions. Over 5+ years, we have deployed WAFs on 30+ projects — from high-load SaaS to legacy solutions. Our engineers hold AWS and Cloudflare certifications, confirming their expertise. Thanks to WAF, the average incident response time has decreased by 40%. We guarantee 99.9% WAF uptime and reduce false positives to 2-5% after tuning.

WAF solution comparison

The choice of WAF depends on your architecture: ModSecurity for self-built solutions, AWS WAF if your infrastructure is already in AWS, Cloudflare if you use their CDN. AWS WAF is 2-3 times easier to configure than ModSecurity, while Cloudflare WAF reduces false positives by 50% compared to ModSecurity out of the box.

Why deploy WAF with monitoring first?

The typical mistake is to enable WAF in blocking mode immediately. In one project with legacy PHP, after enabling AWS WAF in Count mode, we got 340 CRS hits on normal POST form requests. Tuning exclusions took 3 days. If we had blocked immediately, the application would have crashed. Monitoring mode allows you to collect statistics and avoid disabling important features. After a week of observation and custom exclusions, the number of false positives drops to 2-5%. The recommendations of OWASP CRS emphasize the importance of phased deployment.

ModSecurity module with OWASP CRS on Nginx

ModSecurity is an open-source WAF that works as a module for Nginx or Apache. The OWASP Core Rule Set (CRS) is a rule base covering over 90% of known attacks.

Installation and configuration:

# Ubuntu/Debian apt install libmodsecurity3 libmodsecurity-dev
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
# Recompile Nginx with the module or use the package from nginx.org

load_module modules/ngx_http_modsecurity_module.so;
http {
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/main.conf;
}

# /etc/nginx/modsec/main.conf
Include /etc/nginx/modsec/modsecurity.conf
Include /usr/share/modsecurity-crs/crs-setup.conf
Include /usr/share/modsecurity-crs/rules/*.conf

Modes: DetectionOnly (logs, does not block) and On (blocks). We always start with DetectionOnly, tune exclusions, then switch.

WAF exclusion tuning

OWASP CRS in aggressive mode produces many false positives on real applications. For example, a form with a rich-text editor generates requests that CRS considers XSS:

# /etc/nginx/modsec/exclusions.conf
SecRule REQUEST_URI "@beginsWith /admin/editor" \
    "id:1001,phase:1,pass,nolog,ctl:ruleRemoveById=941100"
SecRuleUpdateTargetById 942100 "!ARGS:content"

Precise exclusions preserve protection for other endpoints. We publish monthly reports on hits, increasing transparency. Processing 1M requests per day, we maintain 99.9% uptime.

AWS WAF

AWS WAF is easier to operate — no server required, managed via API/Terraform, integrated into CloudFront, ALB, API Gateway. Compared to ModSecurity, configuring managed rules is 2-3 times faster.

resource "aws_wafv2_web_acl" "main" {
  name = "production-waf"
  scope = "REGIONAL"

  default_action {
    allow {}
  }

  rule {
    name = "AWSManagedRulesCommonRuleSet"
    priority = 10

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"

        rule_action_override {
          name = "SizeRestrictions_BODY"
          action_to_use {
            count {}
          }
        }
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name = "AWSManagedRulesCommonRuleSet"
      sampled_requests_enabled = true
    }
  }

  rule {
    name = "RateLimitRule"
    priority = 1

    action {
      block {}
    }

    statement {
      rate_based_statement {
        limit = 2000
        aggregate_key_type = "IP"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      cloudwatch_metrics_enabled = true
      metric_name = "RateLimit"
      sampled_requests_enabled = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name = "ProductionWAF"
    sampled_requests_enabled = true
  }
}

We use AWS WAF documentation. We configure CloudWatch metrics to monitor 99.9% uptime.

Cloudflare WAF

Cloudflare WAF works before traffic reaches your infrastructure. Managed Rules are automatically updated against current threats. Deployment is 3 times faster than ModSecurity.

resource "cloudflare_ruleset" "zone_waf" {
  zone_id = var.zone_id
  name = "Custom WAF Rules"
  kind = "zone"
  phase = "http_request_firewall_custom"
  rules {
    action = "block"
    expression = "(http.request.uri.path contains \"wp-admin\" and not ip.src in {10.0.0.0/8})"
    description = "Block wp-admin from outside"
    enabled = true
  }
  rules {
    action = "challenge"
    expression = "(cf.threat_score gt 20)"
    description = "Challenge high threat score"
    enabled = true
  }
}

What's included in turnkey WAF setup?

1. Application and traffic audit: log analysis, identification of vulnerable areas.
2. WAF selection (ModSecurity / AWS / Cloudflare) based on your infrastructure.
3. Deployment in monitoring mode: collect hits, analyze false positives.
4. Exclusion configuration for legitimate requests.
5. Switch to blocking mode with custom rules (rate limiting, geo-blocking).
6. Documentation: rule list, exclusions, team instructions.
7. Developer training on working with WAF logs.

Timeline and cost

Pricing is determined individually after an application and traffic audit. Typical savings on security incidents are 30%.

How we guarantee results?

Certified engineers with over 5 years of WAF experience, deployed on 30+ projects. We follow official best practices: OWASP CRS recommendations, AWS Well-Architected Framework. At each stage we provide artifacts: monitoring reports, configuration changes, incident runbooks. We guarantee a reduction in false positives to 2-5% after tuning.

Want to protect your project? Get a consultation — we'll analyze your architecture and propose the optimal solution. Order a WAF audit and we'll show you how to cut your security budget by 30%.