[tehalex]

Agree for our apps.

However, for 3rd party code we run/host but don't really own I see value to a WAF. For example, we unfortunately run WordPress, and I don't have time to manually audit all of the stupid plugins people want to be installed beyond a checker for known vulnerabilities, so a WAF is some comfort/protection.

[thestepafter]

Agreed on the 3rd party code having a WAF.

What WAF solution are you using for WordPress?