Support

WAF does add a slight overhead (a mere 0.05 seconds per page load) but offers a completely different kind of protection than Apache's mod_security. It is a web application firewall, not a web server firewall. I recommend using both of them, as well as sane administrative techniques, to keep your site protected.

Example: Turning off WAF and having mod_security will not stop an attacker from brute-forcing your Super Administrator password. They will simply write a script to fetch http://www.yoursite.com/administrator/index.php page, parse the token, submit your username with a random password and let it run for a few days. With WAF enabled you will be protecting access to that URL through a secret key. If the attacker tries a few times to crack that secret key, you can auto-ban his IP for a few hours. Effectively, a brute force attempt would now have to take several hundred of years to complete instead of a few hours to a couple of days. IMHO, the 0.05 seconds per pageload tradeoff is very well worth this added protection! Want some proof? This site. It uses both mod_security and Admin Tools Professional.

If you want to disable WAF anyway, there are two ways to do that:
1. Go to WAF Configuration and turn everything off.
2. Unpublish the System - Admin Tools plugin from Joomla!'s plugin manager. In this case you lose all features of Admin Tools, including URL redirection, scheduling of maintenance operations and the SEO and Link tools.

You're welcome!