Why might a custom WAF rule appear to work (i.e., it's being triggered) but not block traffic, and how do 'Log' or 'Challenge' actions affect its perceived effectiveness?

If a custom WAF rule is triggered but doesn't block traffic, it's likely configured with an action other than 'Block.' The 'Log' action records the event in Firewall Events without affecting the request. 'Challenge' actions (like CAPTCHA or JS Challenge) require user interaction to proceed, but they don't outright block the request. To achieve immediate blocking, ensure the rule's action is explicitly set to 'Block'.