anchor.diff:    include "includes/waf.vcl";
     if (!(req.http.RULE == "")) {
       std.log( "ATTACK SIGNATURE rules:"+req.http.RULE+" url:"+req.url+" COOKIE:"+req.http.Cookie+"   IP:"+client.ip);
  -    error 403 "ATTACK DETECTED - IP LOGGED";
  +    return (synth(403, "ATTACK DETECTED - IP LOGGED"));
     }
     unset req.http.EXCE;
     unset req.http.RULE;
  
positive.code:   <%- if @blockedips.length > 0 -%>
    # blocked list
    if ((client.ip ~ blockedips)<%- if @blockedbots.length > 0 -%>||(req.http.User-Agent ~ "(?i)<%- @blockedbots.each do |bot| -%><%= bot %><%- if cookie != @blockedbots[-1] -%>|<%-end-%><%-end-%>")<%-end-%>) {
      error 403 "Access forbidden.";
    }
    <%- end -%>
  
  
negative.code:   # Allows purge for the IPs in purge ACL
    if (req.method == "PURGE") {
      if (!(client.ip ~ purge)) {
        return (synth(405, "Not allowed."));
      }
      ban(" req.url == " + req.url);
      set req.url = regsuball(req.url,"80","443"); 
  