What should be the custom response code when WAF blocks a request due to matched rules or policy violation. We should kept the response code as 403 or 200 when WAF returns a response against a blocked request. What is the general security practice and why

1 Answer 1


I don't think there is a standard way, however there is a code 401 "Unauthorized", 403 "Forbidden", or even the code 450 "Blocked by Windows Parental Controls" and I think cloudfare are using their own codes. My suggestion is don't bring too much information to the attacker about the reason and probably just reject with a 401 or something standard. Take into account that if you respond with a 4xx "Firewall blocked" the attacker will know that you are using a waf.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .