WAF rules: Penalty box conditions