I’m building a public API and need WAF rules for abuse, rate limiting, and invalid requests. Which option is best?

For a public API, the best choice is usually:

A WAF managed rule set + custom rate-based rules + API schema/validation checks

If you mean “which WAF option” in general, the safest practical setup is:

1. Managed rules for common attacks
   • SQLi, XSS, path traversal, protocol abuse, bad bots, known CVEs
2. Rate limiting / throttling
   • Per IP, per API key, per token, and ideally per route
3. Request validation
   • Enforce method, content type, size limits, header sanity, JSON schema, allowed query params
4. Bot/abuse controls
   • Challenge suspicious traffic, block empty user agents, invalid auth patterns, high-error clients
5. Logging + alerting
   • You need visibility to tune false positives and detect abuse

If you’re choosing among common WAF approaches:

• Best overall for public APIs: a WAF that supports API-specific rules and rate limiting
• Best for minimizing maintenance: a managed cloud WAF with API protection features
• Best for strict request correctness: combine WAF with an API gateway and backend validation

What to look for specifically

• Rate limit by:
  • IP
  • API key / client ID
  • User account
  • endpoint/path
  • HTTP method
• Invalid request protections:
  • malformed JSON/XML
  • oversized bodies
  • bad content types
  • unknown headers/parameters
  • schema mismatch
• Abuse protections:
  • credential stuffing
  • scraping
  • enumeration
  • excessive 4xx/5xx patterns
  • burst control and sustained limits

Practical recommendation

If you want a single answer:
Use a managed WAF with API protection rules plus custom rate-based rules, and enforce schema/validation at the API gateway/backend.
A WAF alone is not enough for invalid requests; it should be part of a layered API protection setup.

If you want, I can also recommend a concrete rule set for AWS WAF, Cloudflare, Azure WAF, or Fastly.