2 things to fix

Impact

Effort & risk

.

How to measure

Rescan after deployment and review false positives and application error rates.

Assumptions

• Checked: zone and account managed-firewall entry points. None has an enabled rule that runs a managed ruleset for this site. This can mean no rules exist, all are switched off, or they target other sites only.
• Deployment absence does not prove an attack occurred.
• Paid entitlement and commercial value require separate confirmation.

Evidence

• Zone inventory

  Fictional active zone: assets.example.com.

• Customer confirmation

  Fictional customer marked this scope production and non-test.

• Zone managed-WAF entrypoint

  Fixture confirms readable zone scope with no effective deployment.

• Applicable account managed-WAF entrypoint

  Fixture confirms readable account scope with no applicable deployment.

• HTTP analytics

  500,000 eyeball requests; 12 GB response bytes; seven complete UTC days; unsampled fixture.

Impact

116,000 static requests reached your server in 7 days.

Effort & risk

About 30 minutes. Low risk. Clear the cache if anything looks out of date.

How to measure

Compare origin-contact share in equivalent seven-day windows after the change.

Assumptions

• MISS, EXPIRED, and REVALIDATED indicate origin contact, not guaranteed avoidable traffic.
• The cohort is confirmed public and static; intentional bypass is excluded.
• MISS/EXPIRED traffic persists on at least three distinct days in the cohort, not necessarily for the same object.
• The owner confirmed that purges, deployments, development mode, or cache-policy changes do not explain the window’s misses.

Evidence

• Zone inventory

  Fictional active zone: assets.example.com.

• Customer confirmation

  Fictional customer marked this scope production and non-test.

• HTTP analytics

  500,000 eyeball requests; 12 GB response bytes; seven complete UTC days; unsampled fixture.

• Cache cohort and configuration review

  200,000 confirmed public static requests; 116,000 origin contacts; 105,000 MISS/EXPIRED. Repeated misses and cache intent confirmed; private/API/auth traffic excluded.