Also a WAF isn't magical. I remember the whole 8KiB AWS WAF bypass thing.