When you only use a WAF