I was also having this issue, and it appears my user.ini file was being edited by the MalCare plugin, which I think was deactivating the Full WAF mode in Ninja Firewall. I use Cloudways hosting and they have MalCare Bot Protection enabled. Is it recommended to use both MalCare Bot Protection and Ninja Firewall? If not, which is better?