Web Application Firewalls (WAFs): A false sense of security? 

This article argues that while web application firewalls (WAFs) can block malicious requests, overreliance can hinder effective penetration testing and mask underlying weaknesses; common bypasses (header/IP spoofing, oversized requests, obfuscation) and gaps such as business logic and authorization flaws remain unaddressed, with a case of a custom WAF mistakenly banning load balancers. It recommends robust application security, secure and well-maintained WAF configurations, and routine assessments conducted without the WAF to ensure true resilience.