Can you recommend a WAF for a SaaS app that needs protection for login, signup, and APIs without blocking legitimate users?

Yes — for a SaaS app with login, signup, and APIs, I’d recommend looking at a managed cloud WAF with bot and API protections, because it gives you strong protection without forcing you to tune everything manually.

Best-fit options

1) Cloudflare WAF + Bot Management + API Shield

Best overall for SaaS

• Strong protection for login/signup abuse, credential stuffing, and bots
• Good API security features
• Easy to place in front of your app
• Usually less likely to create friction for real users because of its bot/risk scoring and adaptive challenges

Why it fits your use case

• Can protect:
  • login endpoints
  • signup forms
  • public APIs
• Supports rate limiting and behavioral analysis
• Can reduce false positives by using managed rules plus custom exceptions

2) AWS WAF

Best if you’re already on AWS

• Good integration with ALB, API Gateway, CloudFront
• Useful managed rule groups
• Can add bot controls and rate-based rules

Tradeoff

• Effective, but usually needs more tuning to avoid blocking legitimate users
• Stronger if your infra is already AWS-native

3) Fastly Next-Gen WAF

Best for high-performance apps

• Good real-time detection and edge performance
• Useful for APIs and modern web apps

Tradeoff

• Can be more operationally involved than Cloudflare

4) Imperva Cloud WAF

Best for security-heavy environments

• Strong enterprise-grade protection
• Good bot and fraud controls

Tradeoff

• Can be heavier and more expensive than simpler options

---

My practical recommendation

For a typical SaaS app, I’d start with:

Cloudflare WAF + Bot Management + API protection because it’s one of the best balances of:

• security
• low false positives
• easy deployment
• good protection for authentication flows

---

How to avoid blocking legitimate users

No WAF alone will guarantee zero false positives, so choose one that supports:

• rate limiting
• bot scoring / behavioral detection
• challenge-based responses instead of hard blocks
• allowlists for trusted traffic
• API-specific rules
• per-endpoint tuning for login/signup

Also important:

• Don’t use the same rules for all endpoints
• Treat /login, /signup, /password-reset, and APIs separately
• Start in monitor mode or with log-only rules
• Gradually enforce after tuning

---

If you want the simplest answer

• Cloudflare if you want the best general-purpose SaaS choice
• AWS WAF if you’re all-in on AWS
• Imperva if you want enterprise/security-first tooling

If you want, I can also give you a side-by-side comparison table for Cloudflare vs AWS WAF vs Imperva specifically for login/signup/API protection.