AWAF Brute Force protection not working for HTML Web application

Hello Ahmed,

Please make sure that the brute force settings in the learning and blocking settings is enabled, (blocked).

and modify the brute force profile and select the login page created in the ASM policy inside the brute force protection. if you have finished these steps, you can start changing the login condition:

• for example try expected status code "302" as the response was 302.
• or unexpected status code, for example "200"
• Or unexpected string in the response and check for a string that shows when you login with wrong credntials, for example "login failed".

All of these results (expected and unexpected) can be found in the developer tool inside the response and headers tab.