WAF limitations