Fix: the paranoia level setting now takes effect
The Paranoia Level slider on WAF Config had no effect. Every site ran at paranoia level 1, whatever it was set to.
Two things caused it:
- The platform set the OWASP CRS v3 variable name. The bundled CRS v4 uses different names, so it ignored the setting.
- The setting was applied after the CRS rules had already checked the paranoia level.
Both are fixed. The anomaly threshold setting was not affected and has always worked.
⚠️ Read before upgrading if you set paranoia level 2, 3 or 4
If your WAF Config paranoia level is above 1, it will start being enforced after this upgrade. Higher levels turn on many more rules, so expect stricter blocking and possibly new false positives on legitimate traffic.
If you set the level to 1 (the default), nothing changes for you.
If your level is above 1, either:
- Set it back to 1 under WAF Config before upgrading, then raise it gradually once you've checked the logs, or
- Put sensitive sites in Detection mode (Sites → Edit) for a while after upgrading. Then review WAF Logs for new detections before switching back to blocking.
No manual steps are needed to apply the fix. The admin API rewrites the WAF configuration automatically when it starts.
Upgrade
docker compose pull
docker compose up -d
latest points to this release. If you pin versions, set WAF_IMAGE_TAG=1.0.21 (no v prefix) before pulling.
Images: ghcr.io/socfortress/waf-caddy:1.0.21, ghcr.io/socfortress/waf-admin-api:1.0.21, ghcr.io/socfortress/waf-admin-ui:1.0.21