In Netlify Security documentation, there is a schema about their architecture :

Where can I find all WAF rules ? is it possible to configure them (apart from Headers) ? Can't see the rules in dashboard. I have a Pro account.

CodePudding user response：

I don’t believe they list the WAF rules. In the architecture it’s labeled as “managed” which means they take care of it.

Given the breadth of customer use cases, my assumption is that the WAF covers only basic issues with an extremely low false positive rate.

There is no reference to it in the docs or the forums. Best to open a support ticket if you have a specific requirement (which usually get a quick response in my experience).