Support

I believe that you are describing something incorrectly. The 504 error is misleading. It is an error message from a proxy, telling you that it couldn't get a reply from your site in a reasonable amount of time. Most likely your server is set up with Apache as the main web server, serving all your PHP-generated pages, with NginX or Varnish in front of it to serve static content faster. In this kind of setup the client (your web browser) connects to the proxy (NginX, Varnish, ...) which connects to the web server (Apache) to generate the page. When PHP, running inside Apache, takes a long time to generate the page OR if there is a PHP fatal error without a response (error message) the proxy is confused and generates the 504 error.

So, by your account, PHP crashes when you are trying to save the WAF configuration if it includes an email address. The content of the WAF configuration setting doesn't play any role in the process of saving that. Therefore entering an email in the WAF configuration shouldn't cause your server.

If this is what happens anyway: please contact your host. The most likely problem in this case is a server protection which blocks POST requests containing certain combinations of content. The WAF configuration data would seem to trigger it if you include email addresses.

If this is NOT what happens: please explain exactly when you get the 504 error message and what were your previous steps. For example, do you get that when a security exception is triggered in the front-end? If it only happens when a security exception is triggered the problem is either with the mail setup of your site or the server's proxy settings. If your site cannot send emails it will take a long time, typically 10-30 seconds, before Joomla's mail subsystem gives up. The proxy would think this is a server timeout, triggering the 504. Likewise, if the proxy has a very low timeout threshold even the regular sending of emails (as long as 5 seconds if you're using an SMTP server) would make the proxy falsely believe it's a server timeout triggering the 504 error.