A method for improving the performance of a web application firewall, the method performed by one or more servers, each of which comprises circuitry forming one or more processors and memory storing instructions for execution on the one or more processors, the method comprising: A. pre-processing a firewall rule, comprising: receiving a firewall rule for execution by a web application firewall, the firewall rule comprising a regular expression to be applied to an input to find a signature therein, the firewall rule further comprising one or more actions for the web application firewall to take upon finding the signature; wherein the input comprises at least a portion of an HTTP message; analyzing the firewall rule to determine a property the input must have in order for the input to have the potential to trigger the firewall rule; wherein the property comprises at least one of: (i) a minimum length and (ii) having only a particular set of one or more characters; B. subsequent to said pre-processing of the firewall rule, operating the web application firewall, said operation comprising: receiving a particular input from a network interface of the server, the particular input comprising at least a portion of a particular HTTP message; testing the particular input to determine whether it has the property; upon a determination that the particular input does not have the property, causing the web application firewall to bypass execution of the rule on the particular input; upon a determination that the particular input has the property, causing the web application firewall to execute the rule on the particular input. A. pre-processing a firewall rule, comprising: receiving a firewall rule for execution by a web application firewall, the firewall rule comprising a regular expression to be applied to an input to find a signature therein, the firewall rule further comprising one or more actions for the web application firewall to take upon finding the signature; wherein the input comprises at least a portion of an HTTP message; analyzing the firewall rule to determine a property the input must have in order for the input to have the potential to trigger the firewall rule; wherein the property comprises at least one of: (i) a minimum length and (ii) having only a particular set of one or more characters; receiving a firewall rule for execution by a web application firewall, the firewall rule comprising a regular expression to be applied to an input to find a signature therein, the firewall rule further comprising one or more actions for the web application firewall to take upon finding the signature; wherein the input comprises at least a portion of an HTTP message; analyzing the firewall rule to determine a property the input must have in order for the input to have the potential to trigger the firewall rule; wherein the property comprises at least one of: (i) a minimum length and (ii) having only a particular set of one or more characters; B. subsequent to said pre-processing of the firewall rule, operating the web application firewall, said operation comprising: receiving a particular input from a network interface of the server, the particular input comprising at least a portion of a particular HTTP message; testing the particular input to determine whether it has the property; upon a determination that the particular input does not have the property, causing the web application firewall to bypass execution of the rule on the particular input; upon a determination that the particular input has the property, causing the web application firewall to execute the rule on the particular input. receiving a particular input from a network interface of the server, the particular input comprising at least a portion of a particular HTTP message; testing the particular input to determine whether it has the property; upon a determination that the particular input does not have the property, causing the web application firewall to bypass execution of the rule on the particular input; upon a determination that the particular input has the property, causing the web application firewall to execute the rule on the particular input.