Scenario ⑤ · WAF action = Log (Enterprise)

📋 This page passing = expected — Log only records, it never blocks

With the Log rule on, this URL (https://oldm.nc-demo.cf/demo/log.html) serves normally (HTTP 200). That is the point: you watch traffic for a while without changing the user experience, then decide whether to escalate to Block.

Audience demo

  1. WAF → Custom rules: match URI Path contains "/demo/log.html" → action Log.
  2. Refresh this page a few times — it keeps loading (no interruption).
  3. Security → Analytics: filter to this path/rule → you see every match logged, with no block applied.
  4. Flip the action Log → Block live and reload: now the custom 403 appears.

Talk track: "Zero-risk rule rollout — see what the rule would block before it blocks."

← Back