Fire common web attacks at the protected app and watch the WAF respond
Each button sends a real HTTP request to this same origin — so it passes through the WAF before it could ever reach the backend. BLOCKED (403) means Coraza + OWASP CRS stopped it. ALLOWED (200) means it reached the app.
These should all be blocked while the site is in blocking mode.
The WAF must let real users through. The last one is the analyst false positive.
Newest first. Cross-reference these in the platform's Logs view.