Our tuning article argued defaults fail twice; this is the article about proving it, and proving your fixes. A WAF untested is a WAF assumed, and assumptions about security controls have a distinguished failure history. The testing discipline is straightforward and rarer than it should be.
The three measurements
A WAF has exactly three behaviors worth quantifying: true blocks (attack payloads caught), false negatives (attacks passed), and false positives (legitimate traffic blocked). Testing means driving known traffic of both kinds and counting. Open attack corpora and framework-specific payload sets cover the malicious side; your own captured legitimate traffic, replayed, covers the other, and the false-positive count against real user patterns is the number that predicts support tickets.
Methodology that yields truth
Test in detection-only mode against production-mirrored traffic where possible, staged environments drift from reality in exactly the header and encoding details WAF rules key on. Vary encodings deliberately (URL, unicode, chunking, content-type games): evasion is an encoding game, and a ruleset tested only against textbook payloads has been tested against textbook attackers. Version everything: ruleset version, payload corpus version, results, so the quarterly re-run produces a diff, not an anecdote.
The organizational insight testing surfaces: WAF quality is a partnership artifact, vendors ship engines and base rules, but efficacy against your application is co-produced by your tuning, your exceptions and your test corpus, which means the vendor-selection question from our comparison articles is incomplete without the operability question: how testable is this platform? Staging policy support, traffic replay tooling, detection-mode fidelity, rule versioning and export, these features determine whether the quarterly discipline above is an afternoon or an ordeal, and platforms differ widely. A modestly-ranked engine your team can test and tune beats an analyst-quadrant leader nobody dares touch; measured beats prestigious, in WAFs as everywhere else in this series.
API and modern-surface coverage
Browser-era test suites under-cover API estates: add schema-violation payloads, authorization-bypass probes (the BOLA family from our WAF article), GraphQL-specific abuse (introspection, depth bombs, batched mutations) and JSON-encoded injections that pattern rules built for form bodies miss. If your WAF claims API awareness, the test corpus is where the claim gets audited; vendors’ own test scripts are, unsurprisingly, tuned to pass.
In practice
Quarterly cadence: replay the legitimate corpus (false-positive regression), run the attack corpus with encoding variations (efficacy regression), diff against last quarter, and feed findings into the tuning loop with owners and dates. After any ruleset upgrade or vendor migration, run the full suite before enforcement, rule engines differ enough that a migrated policy is a new policy. An afternoon per quarter converts your WAF from an installed product into a measured control, which is the entire difference the auditors and the attackers both care about.
WAF efficacy tests here ship the corpus, the method and the quarterly diff format. The first false-positive count is usually the motivator.