Existing state
- Managed WAF rules with service-specific exceptions
- Production paths that depended on historical bypasses
- Different environments with different traffic characteristics
- DNS, TLS and origin behavior coupled to application availability
Case study / Edge security
Cloudflare WAF, DNS and TLS engineering with safer production rollout.
An internet-facing application estate was hardened by tightening WAF behavior, restructuring exception handling, managing DNS changes in phases and improving certificate lifecycle planning without turning edge security changes into uncontrolled production events.
Context
Edge security was already protecting production traffic, but accumulated exceptions and ownership gaps increased change risk.
The environment relied on Cloudflare for WAF enforcement and edge controls across multiple services. DNS and certificate management had to evolve at the same time, so security policy, routing and TLS lifecycle could not be treated as unrelated tasks.
Desired operating model
- Exceptions that are explicit, reviewable and owned
- Default-deny behavior where appropriate in lower environments
- DNS changes executed as staged infrastructure changes
- Certificate renewal driven by inventory instead of emergency discovery
Constraints
A syntactically correct WAF change can still be operationally wrong if application behavior is not validated.
The main risk was not whether a rule could be deployed. It was whether legitimate production traffic would still pass after the rule started enforcing the intended policy.
Production traffic differs
Lower environments did not always reproduce the same request shapes, client behavior or integration paths seen in production.
Exceptions had history
Some WAF bypasses existed because of previous incidents or service behavior that was not obvious from the rule definition alone.
Requester context mattered
Removing or narrowing an exception required application context from the team that originally requested or depended on it.
DNS cutovers are stateful
Authoritative DNS changes required import, Infrastructure as Code alignment, nameserver cutover and a rollback plan rather than a single console edit.
Certificate consumers were distributed
Wildcard certificates could be referenced by multiple load balancers or services, so renewal strategy required consumer discovery first.
Observability was essential
WAF events, origin responses and deployment timing had to be visible enough to distinguish application failures from edge enforcement.
Approach
Treat edge configuration as production software: inventory, review, validate, deploy and observe.
The operating model focused on making risky changes smaller and easier to reason about, with explicit ownership and rollback conditions.
Inventory policy and consumers
Map WAF rules, exception paths, DNS zones, certificate consumers and origin dependencies before changing enforcement.
Define expected behavior
Document what should be allowed, challenged or blocked and identify the application owner who can validate that behavior.
Validate representative traffic
Use available non-production traffic, request replay or controlled production observation to understand how the rule behaves before broad enforcement.
Stage the rollout
Apply changes incrementally, preserve a known rollback path and watch WAF and origin signals during the change window.
Promote the stable baseline
Once behavior is understood, align lower environments and documentation to the validated policy rather than maintaining silent drift.
WAF hardening
Exception cleanup was treated as a behavior change, not a housekeeping task.
A previous production change demonstrated that removing an exception can immediately reactivate blocking on traffic that had been bypassing inspection. The recommended process therefore included application-owner review and explicit acceptance criteria before enforcement changes.
Rule intent first
Each exception was tied to the application behavior it protected instead of being kept as an unexplained path pattern.
Requester sign-off
Teams depending on an exception were expected to confirm the behavior that must continue after the change.
Security review
Changes continued through peer and security review, but review was not treated as a substitute for application validation.
Rollback conditions
Blocking symptoms and rollback actions were defined before production enforcement so recovery did not depend on improvisation.
Lower-environment enforcement
Where appropriate, obsolete hostnames and broad access patterns were removed so non-production environments did not remain permanently permissive.
Traffic evidence
WAF events and application responses were used to separate legitimate detections from false positives and service-specific exceptions.
DNS and TLS
Routing and certificate lifecycle were moved toward planned, reviewable changes.
DNS migration and certificate renewal were handled as infrastructure lifecycle work, with explicit phases and dependency discovery before cutover.
Authoritative DNS migration
- Import and compare the existing zone before cutover
- Represent target records through Infrastructure as Code
- Validate records and dependent services before changing nameservers
- Perform nameserver cutover as a separate controlled phase
- Keep rollback and propagation behavior visible during transition
Certificate renewal strategy
- Discover active wildcard certificate consumers
- Group SAN certificates by service, team or environment where practical
- Keep only the minimum legacy wildcard coverage required
- Plan certificate replacement before the renewal window becomes urgent
- Coordinate load balancer and origin updates with application owners
Outcome
Edge changes became easier to review, safer to roll out and less dependent on undocumented exceptions.
No synthetic incident reduction or availability percentage is claimed. The result is described in terms of the delivered operating model and infrastructure state.
Tighter WAF policy
Exception handling was reduced and made more explicit so enforcement behavior was easier to reason about.
Better change discipline
Production WAF changes incorporated requester context, acceptance criteria, validation evidence and rollback planning.
Lower-environment cleanup
Unneeded hostnames and permissive access patterns were removed where the target policy required stricter defaults.
DNS cutover became staged
Zone import, Infrastructure as Code alignment and nameserver migration were separated into independently reviewable phases.
TLS lifecycle became visible
Certificate renewal planning started from consumer inventory instead of assuming a wildcard could be replaced safely everywhere at once.
Operational signals mattered
WAF and origin behavior were treated as part of change validation rather than something checked only after an incident.
Technology
Edge security combined application policy, routing, certificates and operational controls.
The work crossed traditional ownership boundaries because WAF, DNS, TLS and origin behavior all affected the same production request path.
Edge controls
- Cloudflare WAF and managed rules
- Custom rules and exception handling
- DNS and edge routing
- TLS and certificate management
- Origin protection
- Security event analysis
Delivery controls
- Infrastructure as Code
- Pull request review
- Security review
- Application-owner validation
- Staged production rollout
- Rollback and post-change observation
Need to tighten Cloudflare policy without turning the next WAF change into an outage?
Start with the current rules, exceptions, application dependencies and the rollout behavior you need to preserve.