Best practices for WAF rules

The following sections show field-tested WAF rule configurations for the request phase (conditions and actions), the response phase, and URI substitution.