Overview

Deploying a Web Application Firewall (WAF) in front of a live application requires careful planning to ensure that legitimate users and business operations are not disrupted.

The GAJWAF Site Onboarding Playbook provides a structured, six-stage approach to bringing a new website or application under GAJWAF protection while minimizing the risk of false positives and service interruptions.

The playbook follows a simple but important principle:

Watch First. Prove It's Clean. Then Enforce.

Rather than immediately enabling blocking, administrators are guided through a process of observing real application traffic, reviewing detected threats, fine-tuning security policies and validating protection before switching to enforcement.

What You'll Learn

This playbook covers six essential stages of safe application onboarding:

Stage 1: Add the Site and Configure Traffic Routing

Add the website to GAJWAF, configure backend connectivity and HTTPS certificates, and redirect application traffic through the WAF while keeping the site in Detect mode.

Stage 2: Select the Appropriate Security Level

Choose a security policy suited to the application and adjust blocking sensitivity based on its security requirements.

Stage 3: Monitor Real Application Traffic

Allow GAJWAF to observe legitimate application activity, including user logins, searches, file uploads, API requests, administrative operations and scheduled jobs.

Stage 4: Review Potential Blocks and False Positives

Examine security events to identify legitimate requests that might otherwise be blocked. Apply targeted exclusions without unnecessarily weakening the application's overall protection.

Stage 5: Enable Blocking Safely

Switch the site to Block mode after completing the observation and validation process. Monitor blocked requests closely and respond quickly if legitimate traffic is affected.

Stage 6: Complete Security Hardening

Strengthen the deployment by preventing direct access to backend servers, ensuring accurate client IP logging, and enabling security alerts and reporting.

Why Follow This Playbook?

A poorly planned WAF deployment can interfere with legitimate application traffic, particularly when applications have complex workflows, custom APIs or third-party integrations.

Following this playbook helps administrators:

  • Reduce the risk of disrupting live applications during onboarding.
  • Identify and resolve false positives before enabling enforcement.
  • Apply security policies appropriate to each application.
  • Maintain a rollback option during deployment.
  • Prevent attackers from bypassing GAJWAF and reaching backend servers directly.
  • Validate that security monitoring, logging and alerts are operating correctly.

Deployment Validation Checklist

The playbook includes a final sign-off checklist to help administrators confirm that:

  • The site is operating in Block mode.
  • Legitimate application traffic is functioning correctly.
  • Backend access is restricted to the WAF.
  • Real client IP addresses are recorded correctly.
  • Multi-node configurations are consistent, where applicable.
  • The deployment has been reviewed and approved.

Download the Playbook

Document: GAJWAF Playbook – Onboard a Site Safely
Document Type: Technical Deployment Playbook
Publication: October 2026
Pages: 6
Intended Audience: GAJWAF Administrators and Security Analysts

Attachment: GAJWAF_Playbook_Onboard_Site_Safely.pdf

Download the attached playbook for detailed instructions, configuration references, validation criteria and the deployment sign-off checklist.

Related Documentation

For additional guidance, refer to the following documents in the GAJWAF Knowledge Base:

Technical Assistance

For assistance with GAJWAF deployment, configuration or troubleshooting, contact GajShield Technical Support or your authorized GajShield partner.

Website: https://www.gajshield.com

GAJWAF: Different Applications. Different Protection. Shared Risk Intelligence.