I would say WAF is also not that useful addition when you develop new applications. Especially if you use new frameworks and ORM. Most of crap hitting servers

I would say WAF is also not that useful addition when you develop new applications. Especially if you use new frameworks and ORM. Most of crap hitting servers is old exploits targeting popular CMS. WAF is useful if you have to filter out traffic and you don’t know what might be exposed on your infra. Like that Wordpress blog that marketing set up 3 years ago and stopped adding posts and no one ever updated it.