A response rule is a web application firewall (WAF) rule that examines the content the origin server sends back to the client, rather than the request that came in. Most WAF rules look at incoming requests, such as URLs, headers and bodies. A response rule looks at outgoing responses, for example for error messages, leaked data or other content that should not leave the server.
Because it runs after the origin has already handled the request, a response rule works differently from a request rule. It can block, alter or flag what is returned, but it cannot undo anything the server has already done. If a request caused code to run or data to change on the origin, stopping the response does not reverse that.
Response inspection also has practical limits. Support differs between WAF products and plans, large or compressed responses can be harder to inspect, and a rule only catches the patterns it was written to match. A response rule can reduce what an attacker learns from a failed or partly successful attempt, but a quiet response does not prove that nothing happened.
Treat response rules as a supporting control. They are most useful for limiting information leakage and for giving defenders an extra signal in the logs. They do not replace fixing the underlying vulnerability, so keep applying vendor updates, and review origin logs as well as WAF logs when investigating a possible incident.