You need to enable the Web Application Firewall on the Application Gateway.
In the Azure portal, type Application gateways in the search box, select Application gateways from the search results then select the gateway named Homepage-AGW. Alternatively, browse to Application Gateways in the left navigation pane.
In the properties of the application gateway, click on Web application firewall.
For the Tier setting, select WAF V2.
In the Firewall status section, click the slider to switch to Enabled.
In the Firewall mode section, click the slider to switch to Prevention.
Click Save to save the changes.