Match Type Matters: “Matches” vs. “Begins With” in WAF URL Allowlist Rules
⚡ Quick Fix (TL;DR)
The Culprit: An allowlist rule for /wp-json/ saved successfully under "Matches" mode but had zero measurable effect — because "Matches" requires an exact, full-path match, while real REST requests hit longer sub-paths (e.g. /wp-json/wp/v2/types/post?context=edit).
The Fix: Switching the match type to "Begins with" made the rule cover everything under /wp-json/, not just the bare path. URL-path rules in most WAF/CDN tools offer distinct match modes (Matches/Exact, Begins With, Contains, Ends With) — a rule that saves cleanly can still be functionally inert if the match type doesn't fit the actual request shape.
Tagged in :
More from the field
Bisect to an Empty Baseline Before Trusting Any Single Theory
.
Multiple plausible-sounding theories for a bug each turned out to be wrong when actually tested – time was spent building fixes…
A Security Dashboard’s Activity Log Can Lag a Full Day Behind Real Time
.
Trying to check a security tool’s activity log for an event that had just happened showed nothing at all.