WAF Checker © 2026
Read my blog at yoursec.substack.com
⚠️
🛡️ WAF Detection Results
🕵️ WAF Reverse Engineering & CRS Matrix
📈 Test Analytics
Settings
HTTP Methods
🎯 Testing Options
⚡ Advanced Payloads
🔌 Protocol Testing
🎯 Origin IP Override
Know the real server IP behind the WAF? We keep requesting the domain (so the Host header and TLS stay correct) but resolve it to this IP, to test whether the origin is exposed and reachable past the WAF. Public IPs only.
📝 Custom Headers
📄 Request Body Template
Use {PAYLOAD} as a placeholder ❤️ Say Thanks
🔄 Batch Testing
Enter HTTP/HTTPS URLs, one per line. Invalid URLs will be ignored.
Client-side delay to avoid overwhelming target servers
Progress 0%
Current URL: -
Completed: 0 / 0
Estimated time remaining: -
Batch Results Summary
🛡️ WAF Virtual Patching Studio (Auto-Remediation)
🛡️ No bypasses detected! All tested attack vectors were successfully blocked by your WAF. No virtual patches are currently required.
native 

						

					

				

				

					0 rules generated
					

						
						
						
					

				

			

		

	


	
	

		

			

				

					
About WAF Checker

					
				

				

					
WAF Checker is a lightweight tool for verifying Web Application Firewall (WAF) effectiveness
						against common web attacks. It helps security professionals and developers identify gaps in WAF
						rules.


					
🚀 Key Features

					
    
						
  • Check Button (▶): Runs the selected payload tests against the target URL.
						
    • 
						
  • Detect WAF (🛡️): Identifies the WAF vendor protecting the site.
    • 
						
  • HTTP Tests (🔄): Checks for HTTP verb tampering and method handling issues.
						
    • 
						
  • Batch Test (📋): Allows scanning multiple URLs in sequence.
    • 
					


					
🎯 Settings & Options

					
    
						
  • HTTP Methods: Select which methods (GET, POST, etc.) to use for testing.
						
    • 
						
  • Follow Redirects: Inspects responses even if the server redirects (3xx).
						
    • 
						
  • Case Sensitive: Tests if WAF rules are case-sensitive (e.g., matching
							'select' but missing 'SELECT').
    • 
						
  • False Positive Test: Inverts the logic to check if legitimate traffic is
							being blocked. (200 OK = Good, 403 Forbidden = Bad).
    • 
						
  • WAF Bypass Payloads: Uses advanced techniques (obfuscation, encoding) to
							try and evade detection.
    • 
						
  • Auto-detect WAF: Attempts to identify the WAF before running tests to
							tailor payloads.
    • 
					


					

						Note: Always ensure you have permission to scan the target URL.
					

				

			

		

	


	
	

		

			

				

					
⏰ Automated Daily WAF Monitoring & Alerts

					
				

				

					

						Schedule regular daily security audits of your perimeter. Get notified by email (waf@secmy.app) whenever your WAF posture changes, bypasses are detected, or new vulnerabilities emerge.
					


					


					

						

							
							
							
The endpoint or website to be audited once a day.

						


						

							
							
							
Where daily change reports and security alerts will be delivered.

						


						
						

							

								🛡️
								

									
Ownership Confirmation (Anti-Abuse & Anti-Spam)

									

										• Matching Domain: If your email domain matches the target website (e.g. alex@example.com for example.com), a 1-click confirmation link is sent directly to your inbox.

										• External / Public Email: If using a public webmail (Gmail, etc.) or different domain, you will confirm via email and place a verification challenge token at /.well-known/secmy-check.txt.
									

								

							

						


						
						

							

								🔐
								

									
Zero-Knowledge Email Privacy & Rate Limiting

									

										All emails are encrypted at rest with AES-256-GCM using an isolated Cloudflare Secret key. Blind HMAC-SHA256 indexing is used for lookups. Scans run strictly once per day per target domain. Every email includes a standard 1-click unsubscribe link.
									

								

							

						


						

							
							
						

					

				

			

		

	


	
	

		

			

				

					
🛡️ Security Test Mode

					
				

				

					
Security Test checks if your WAF properly blocks malicious attack payloads.
							This helps verify your application is protected against common web attacks.

					
    
						
  • ● 200 — WAF did not protect your
							application
    • 
						
  • ● 403 — WAF protected your application
						
    •