A WAF, even the simple one we supply in /conf, is only a tool for an application-fool :) Both take some white-listing experience before it all works but also requires more then basic knowledge to prevent legitimate posts from getting blocked.

You might read through https://groups.google.com/forum/#!forum/naxsi-discuss and see Harry's posts about rule-set updates for naxsi.

One men's data is another men's code.

---
nginx for Windows http://nginx-win.ecsds.eu/