Test request or response header size limits — single large header or many combined

Test the maximum length of a URL path or query string that the proxy accepts

Test whether the proxy passes, strips, or modifies high-ASCII bytes (0x80–0xFF) in request and response headers

Send known attack strings to the server (via header, URL path, query) and check whether the WAF blocks them

Ask the server to send known attack strings back to the browser (via response body, response header) and check whether the WAF blocks them