nginx + ModSecurity v3 + OWASP Core Rule Set ā
Pencarian & login wajar ā seharusnya lolos WAF (200 OK).
Payload berbahaya ā seharusnya diblokir WAF (403).
429 Too Many Requests