WAF protection gaps