Why can't my WAF protect against client-side attacks like Magecart and skimming?

WAFs are designed to analyze HTTP requests coming into your server, but client-side attacks happen after your legitimate content has already been delivered to the user's browser. A malicious script would execute within the browser environment, collecting sensitive data and sending it to attacker-controlled servers. A WAF would not have visibility into that payload by design. Since this activity happens on the client-side after your webserver responds, your WAF never sees the malicious behavior or data theft occurring.