This benchmark was conducted against the CloFix WAF Public Demo Environment and is intended solely for evaluating core attack detection capabilities. The demo environment does not represent a production deployment.
The following enterprise features and production optimizations were intentionally not enabled during testing:
Therefore, the benchmark results should not be considered representative of a fully optimized production deployment.
This report documents an independently reproduced security benchmark of CloFix WAF against OWASP Top 10 attack categories, conducted using open-source testing tools (GoTestWAF, sqlmap, nuclei, ffuf, k6) against a live CloFix-protected bWAPP deployment. Unlike a summary-only benchmark, every figure in this report is traceable to a specific, repeatable tool run, with raw output retained as supporting evidence.
Attack-payload detection across injection (SQLi, RCE, LDAP, XSS, XXE), broken access control, and API security categories was consistently strong across three independent test runs, with detection rates at or near 100% in most categories.
Testing also surfaced a significant, reproducible false-positive issue affecting free-text input fields, a directory-listing exposure revealing the WAF's own automation-detection script, and a substantial divergence between measured performance on the public demo instance and this report's original performance claims. Both security findings and the performance discrepancy are reported in full below, with appropriate caveats, in the interest of giving an accurate picture rather than a purely favorable one.
The benchmark above reflects the basic security policy of the public demo environment. In a production deployment, CloFix WAF's enterprise capabilities would address the findings and significantly enhance protection:
The findings in this report (free-text FP, performance gap, header gaps, directory exposure) are all addressable with enterprise-grade configurations. The demo environment represents a minimal viable security posture, not the product's full potential.
| OWASP Category | Sent | Blocked | Detection Rate | Status |
|---|---|---|---|---|
| A03 – Injection (SQLi, RCE, LDAP, XXE, SST, mail, shell) | 434 | 430 | 99.1% | Pass |
| A03 – Injection (XSS) | 328 | 326 | 99.4% | Pass |
| A01 – Broken Access Control (LFI, path traversal) | 22 | 22 | 100% | Pass |
| A05 – Security Misconfiguration (CRLF, SSI) | 31 | 30 | 96.8% | Pass |
| API Security (REST, SOAP, non-CRUD) | 14 | 14 | 100% | Pass |
/static/ including challenge.js
k6 avg latency 8.23s (demo env, under load) - original claims 50k RPS / <3ms require re‑verification
--dbms=MySQL --technique=B found no injectable parameter. WAF interference confirmed.CloFix WAF demonstrated strong, reproducible attack-detection performance across every OWASP category tested with automated tooling, with detection rates at or near 100% for injection, XSS, access control, and API security test cases.
Testing also surfaced three issues worth prioritizing: a significant false-positive rate on free-text input fields (98.6% block rate on benign content), a directory-listing exposure revealing the WAF's own bot-detection script, and a large, unexplained gap between this report's original performance claims and what was measured on the public demo instance.
Four OWASP categories (A02, A04, A08, A09) still require manual review beyond automated tooling. This report should be considered complete for automated testing scope, with the noted manual review and performance-verification items as the clear next steps before broader publication.
The findings presented in this report reflect the configuration of the public demonstration environment. Production deployments can enable enterprise rule packs, advanced AI protection, security hardening, and performance optimizations based on customer requirements.