Why did auto-generated whitelisting of a website fall out of use for WAFs, even though a whitelist is in principle the stronger model?

The scanner had to crawl the whole site and identify every allowed interaction. That stopped keeping up with the possibilities, complexity and variety of what is offered on the web, so the method was almost completely replaced by pre-built (blacklist) filter rules.

A whitelist (positive security model) allows only what is known to be good; everything else is denied. That is stronger in principle, because an unknown attack is blocked by default. A blacklist (negative security model) blocks what is known to be bad and lets everything else through, so a new attack pattern passes until the list is updated.

The whitelist's weakness is that it must know everything that is allowed. Around 2000, websites were mostly static pages and simple forms, and a crawler could plausibly learn them. Modern web applications generate content dynamically, take free-text input, change with every release and expose APIs, so a learnt whitelist is incomplete on day one and outdated after the next deployment. Every gap blocks a legitimate user. The blacklist trades some protection for something that can actually be operated.

Tip: whitelist = "only what I listed"; blacklist = "everything except what I listed".

Go deeper:

• Whitelist — Wikipedia — the positive security model and its maintenance burden.
• Blacklist (computing) — Wikipedia — the negative security model used by most WAF rule subscriptions.