Measure & benchmark your WAF in real time.
Point it at a domain you own. From a real browser we replay attack traffic — OWASP classes, real-world CVEs, API & origin exposure, and bots — and hand you a scorecard of exactly what got through.
scan #d0fe1455 · www.acme.com
WAF efficacy scorecard
Vendor-agnostic — benchmarks any WAF & CDN
Test vectors
Payloads sorted by how attackers actually use them.
Across OWASP classes, real-world CVEs, API & origin exposure, and bots. Every suite runs on every scan, and the full report is yours.
Security check suites
Attack categories
Real-world CVEs probed
Attack probes per scan
WAF payload efficacy
Injection and request-forgery classes from the OWASP Top 10 — SQLi, XSS, command injection, SSRF, SSTI, XXE and more — sent across query, path, header and body placements from a real browser. Up to 800 probes per scan.
Zero-day & CVE
A curated corpus of 10 high-impact CVEs — Log4Shell, Spring4Shell, Struts2, Shellshock, Confluence and more — delivered in their real vectors, including headers. Signature recognition, not exploitation.
API security posture
Unauthenticated, read-only checks for an API8/API9 subset: CORS misconfiguration, missing security headers, TRACE, verbose error leakage, exposed OpenAPI/Swagger and debug endpoints, GraphQL introspection.
Origin IP exposure
Hunts for origin servers reachable directly behind your CDN/WAF — resolving common leak subdomains, classifying IPs against known edge ranges, and confirming with a TLS certificate match.
Bots & rate limits
Grades how your bot defenses treat a gradient of clients — scripted, Python, headless, and a real JS-running browser — and whether scripted clients get fingerprinted. A benchmark, not an evasion tool.
Confidence-scored grade
An A–F grade against an OWASP CRS Paranoia-Level-2 baseline — false-positive-adjusted, and withheld when the measurement is confounded. A number you can act on, not a vanity score.
How it works
Three steps. About three minutes.
Add your domain & prove you own it
Add one DNS CNAME record (_waf-verify). Pick the suites you want, or leave all six on. One record covers apex and www.
We send the payloads
A real browser sends rate-limited probes to apex and www across query, path, header and body — designed to be detected, not to cause damage.
Read the scorecard, fix the gaps
Get a grade, block rate by class, and each request that reached origin — with the rule to add. Export the PDF or retrieve it by scan ID for 14 days.
Benchmarks
Out of the box is not the same as tuned.
Rulesets drift, vendors update signatures, and a single misconfigured rule can silently wave an attack through. Most teams don't find out until a payload reaches the origin. Test My WAF replays the real thing so you know today, not after an incident.
The report
A report your security lead will actually read.
Per-category results, the exact payloads fired, and the requests that reached your origin — ranked by severity and exportable as a shareable PDF.
Illustrative sample. Run your own scan for real numbers.
finding · GET /report
Command injection — bypassed
Find your bypasses before an attacker does.
No agent. No signup. About three minutes.
FAQ
Questions, answered
No. Test My WAF runs entirely from your browser — no agent, no signup, nothing to deploy. Verify a domain you control and run.
A one-time DNS CNAME record (host _waf-verify). One record at the apex covers both your apex and www, and we only fire payloads at targets you have proven you control.
Payloads are crafted, rate-limited attack simulations designed to be detected, not to cause damage. Most teams run against staging first; production is supported when you run it deliberately. This is a benchmark, not an evasion or vulnerability-scanning tool.
12 categories across the OWASP top risks — SQL injection, XSS, command injection, path traversal, SSRF, SSTI, LDAP and NoSQL injection, open redirect, CRLF/header injection, prototype pollution and XXE — fired across multiple request placements, up to 800 probes per scan.
An A–F grade benchmarked against an OWASP CRS Paranoia-Level-2 baseline. It's false-positive-adjusted — we fire benign traffic too and subtract that noise — and the grade is withheld when the measurement is confounded (for example, when the scanner itself is being blanket-blocked), so you never get a misleading score.
Yes. Each scan has an ID — enter it in the app to pull your report back up for up to 14 days after the scan. After that it's purged.
Yes. Every scan produces a downloadable PDF report with per-category results, the exact payloads fired, and remediation notes.