Web application firewall (WAF)

A WAF is different from a network firewall. A network firewall decides which connections are allowed, by address and port. A WAF looks inside the web traffic itself, at URLs, form submissions, headers and cookies, and judges whether a request is trying to exploit the application, for example by slipping database commands into a search box.

A WAF is a safety net, not a substitute for secure software. It buys time against known attack patterns, but a site with outdated plug-ins and weak passwords is still exposed. It also does nothing against phishing or stolen credentials used to log in normally.

How it works

Every request to the site passes through the WAF first. The WAF compares it against rules: known attack signatures such as SQL injection, which tries to run database commands through form fields, and cross-site scripting, which tries to plant malicious scripts in pages. Many WAFs use widely shared rule sets, such as the OWASP Core Rule Set, plus the provider's own rules for newly discovered vulnerabilities in popular software.

Beyond signatures, WAFs can rate-limit, block traffic from known bad sources, challenge suspected bots, restrict admin areas to certain countries or addresses and apply "virtual patches" that block a specific exploit until the real software update is installed.

WAFs come in three common forms: cloud-based services that sit in front of the site, often as part of a CDN; software on the web server, such as ModSecurity; and plug-ins inside a CMS like WordPress. Cloud WAFs stop bad traffic before it uses your server's resources; plug-in WAFs only act once the request has already reached the site. New rules are usually tested in a log-only mode first, because overly strict rules can block real visitors, which is called a false positive.

Example

A travel agency runs a WordPress site with a booking plug-in. A serious vulnerability is announced in that plug-in, and the fixed version will not be compatible with the site's theme for a few days. The agency's cloud WAF provider pushes a rule that blocks requests matching the exploit, and the logs show it stopping thousands of attempts that week.

Meanwhile, staff report that the enquiry form rejects messages containing certain words used in trip descriptions. The developer reviews the WAF log, finds a rule that mistakes those phrases for an attack, and adds a narrow exception for that form field only. The site is updated as soon as the compatible version is ready.

Why it matters for your business

A WAF reduces the chance that an automated attack on a known vulnerability turns into a hacked site, a data breach or downtime, and it is especially useful for sites built on popular CMSs and plug-ins, which attackers scan for constantly. Basic cloud WAF protection is included with some hosting and CDN plans; managed rule sets usually cost extra. The trade-offs are occasional false positives, which need someone to review logs, and a false sense of security if updates are neglected. A small static site with no forms or logins gains less from a WAF than a busy shop or booking site. You can check whether you have one by asking your host or looking at your CDN dashboard.

Common mistakes

• Treating a WAF as a reason to delay software updates, when it only covers attacks it has rules for.
• Turning on strict blocking rules without testing, then losing genuine form submissions or orders.
• Leaving the server reachable directly by its IP address, so attackers can bypass a cloud WAF.
• Never looking at the WAF logs, which show both blocked attacks and wrongly blocked visitors.

Questions people ask

Do I need a web application firewall for a small website?

It depends on the site. If it runs a CMS with plug-ins, has logins, takes payments or stores customer data, a WAF is a sensible extra layer and often cheap or included. A simple static site with no forms gains less, and good updates matter more.

What is the difference between a WAF and a regular firewall?

A network firewall controls which connections are allowed based on addresses and ports. A WAF inspects the content of web requests, such as form fields and URLs, to block attacks aimed at the website's code. Most sites benefit from both, and hosts usually manage the network firewall.

Can a WAF block real customers?

Yes, overly strict rules can block legitimate requests, such as a form message that resembles attack code. Good providers let you run rules in log-only mode first, review blocked requests and add narrow exceptions. Check the logs whenever customers report unexplained errors.