Security
WAF profiles
What a learning session produces is a profile: a short, named list of exceptions that describes how one application differs from what the rules expect. Any number of sites can share it.
Why they are shared
Because most organizations run the same application more than once. A staging site, a production site, a site per customer. They all behave the same way, so they all need the same corrections, and keeping one list is much better than keeping six that slowly diverge.
Editing a profile changes every site using it at the next apply. That is the point of having them, and it is why the list of users is on every card rather than hidden behind a click.
Profiles and rule set versions
A profile names specific rules. When the rule set is updated, a rule it names could have been renumbered or withdrawn. The profiles page shows whether each one still matches the rules installed today, so a profile that has quietly stopped applying is visible rather than a surprise.
Naming them well
Name a profile after the application, not after the site. wordpress-4x or
internal-crm tells the next person what it is for.
shop-exceptions-final-v2 does not.
Worth reviewing once a year
Applications change. An exclusion added because the old editor posted raw HTML is dead weight once the editor has been replaced, and dead weight in a WAF profile is a rule that is not protecting a path that now has nothing on it. A short annual read through the list is cheap and keeps the profile honest.
Common questions
Can a site use more than one profile?
A site is set to one profile. If two applications share a site, the profile has to cover both, which is usually a hint that they should be two sites.
Are profiles included in a backup?
Yes, along with everything else the fleet is configured to do.
What happens to sites using a profile I delete?
They lose those exclusions at the next apply, which means rules that were excused start firing again. The page tells you which sites are affected before you delete it.
Step by step instructions
The how to section has searchable, task shaped answers. Search it for waf profile.