The azure managed waf rules will block your own wp-admin before they block anything else

a client's IT team moved the site behind azure front door with the default managed rule set, told nobody, and then opened a ticket with me saying the site was broken. it was, but not in a way that shows on the front end. everything a visitor does is fine. everything an editor does gets a 403 with a request id and nothing else.

the rules that did it, in the order i found them:

1: the sql injection group fires on gutenberg block content. paste a table, or anything with quotes and a comparison in it, and saving the post is a 403.

2: the xss group fires on raw html in a post, so the one page with an embed in it could not be saved by anybody at all.

3: the php injection group hits admin-ajax for a couple of plugins, which shows up as a spinner that never finishes rather than an error, so the client reports it as the site being slow.

4: the file upload rules cap out well below what the media library allows, so a 12mb pdf uploads for a while and then 403s at the very end.

what makes this miserable is the logging. the request id in the browser is not searchable unless diagnostic settings are on and pointed at a log analytics workspace, and on a lot of these deployments they are not. i spent an afternoon waiting on a network person to switch logging on before i could name a single rule id.

where it ended up was exclusions rather than disabling whole groups. an exclusion scoped to the request body on /wp-admin/post.php for the sql group, another for admin-ajax, upload limits raised to match php. detection mode for a week, read the log, then prevention. anybody who goes straight to prevention on a site with an active editorial team is getting a phone call inside the hour.

i still think a waf in front of wordpress earns its keep, mostly for login and xmlrpc noise, but the managed rulesets are written for generic apps and wordpress does a lot of things that look exactly like an attack. what you are really signing up for is maintaining an exclusion list forever, and the person who owns the waf is almost never the person who