In short
A web application firewall is a filter that sits between the internet and a website or API, inspects each HTTP request against rules that describe known attack patterns, such as SQL injection, cross-site scripting, path traversal and malicious bots, and blocks, challenges or logs the ones that match. Managed WAFs from Cloudflare, AWS, Azure and similar providers are switched on with a setting and cover most sites well. A WAF reduces exposure and stops opportunistic attacks; it does not fix vulnerabilities in the application, and it can block legitimate traffic if tuned carelessly.
What it does
A conventional firewall decides which network connections are allowed, by address and port. It cannot tell a legitimate web request from a malicious one, because both arrive on port 443 looking like HTTP. A web application firewall works at the HTTP layer: it reads the request, the URL, the headers, the query string, the body, and compares them with rules describing what attacks look like. A query parameter containing ' OR 1=1 -- is a SQL injection attempt; a path containing ../../etc/passwd is traversal; a form field containing <script> is probably cross-site scripting; a thousand requests a second from one address to the login page is credential stuffing. The WAF blocks these before the application sees them.
It also provides the bot management most sites need: rate limiting, challenges for suspicious clients, blocking of known bad ranges, and mitigation of volumetric attacks.
The attack classes it addresses
Injection attacks against databases, templates and commands. Cross-site scripting payloads in inputs. Path traversal and local file inclusion. Remote code execution attempts targeting known vulnerabilities in common software, which is where managed WAF rules earn their keep: when a widely used plugin or framework has a disclosed flaw, the providers ship a rule within hours, protecting sites that have not yet patched. Credential stuffing and brute force through rate limits. Scanners probing for known paths. Application-layer denial of service. Malicious file uploads by type and content.
Managed and self-hosted
Managed WAFs run at a CDN or cloud provider in front of the site. Cloudflare's is the most widely used, included in its paid plans with a managed rule set, OWASP core rules and custom rules; AWS WAF, Azure Front Door and Google Cloud Armor serve their platforms; Akamai and Imperva serve enterprises. Turning one on is a configuration change, the rules are maintained by the provider, and traffic is filtered before it reaches your server. For nearly every small and medium site this is the right form.
Self-hosted WAFs such as ModSecurity with the OWASP Core Rule Set run on your own server or in front of it. Free, powerful and yours to tune, and requiring someone to tune them.
Application-level protections, such as security plugins for WordPress, are a partial WAF running inside the application; better than nothing, but they inspect requests only after the server has accepted them.
The false-positive problem
Rules that catch attacks also catch legitimate requests that resemble them. A comment containing a code snippet, a search for a product name with an apostrophe, a form submitting HTML from a rich-text editor, an API client sending JSON that a rule misreads. When the WAF blocks these, users see a 403 with no explanation, and the site owner often does not know.
The remedy is to start in logging mode, review what would have been blocked, tune or exempt rules for the paths that produce false positives, then enforce. After enabling, watch the WAF's event log for a week and check that search crawlers, payment webhooks and API clients are not being caught. A WAF nobody reviews is one that has been silently blocking something for months.
What it does not do
It does not fix the vulnerability. A WAF blocking injection attempts against a form that concatenates SQL is a bandage over a wound that will be found by an attacker who varies the payload. The application must still validate input, use parameterised queries, escape output and keep dependencies patched; the WAF buys time and stops the opportunistic majority.
It does not understand business logic. An attacker who abuses a legitimate feature, such as a discount code endpoint or a password reset flow, sends requests that look normal. It does not protect against compromised credentials, insider misuse, or supply-chain attacks through dependencies. And it does not replace HTTPS, security headers, authentication or backups.
Does a small site need one?
A static site with no forms or logins has very little for a WAF to protect, though the bot filtering and DDoS mitigation that come with it are still useful and the free tiers cost nothing. A site with a CMS, forms, logins or an API benefits from one, because the automated scanning that hits every site on the internet is exactly what a managed WAF is built to stop, and because rules for newly disclosed vulnerabilities protect sites before they patch. For anything handling payments or personal data, a WAF is an expected control.
The practical setup for most sites: put the site behind Cloudflare or the equivalent, enable the managed rule set, add rate limits on login and form endpoints, run in log mode briefly, then enforce and review the events monthly. It is an afternoon, and it is one of the larger reductions in exposure available for the effort. If you would like the configuration reviewed, or a site moved behind a WAF without disrupting its integrations, book a call.
Common questions
What does a WAF protect against?
Attacks carried in HTTP requests: SQL and other injection, cross-site scripting payloads, path traversal, exploitation attempts against known vulnerabilities in common software, credential stuffing and brute force through rate limiting, malicious bots and scanners, and application-layer denial of service. It inspects each request against rules and blocks or challenges matches before the application receives them.
What is the difference between a firewall and a web application firewall?
A network firewall controls which connections are allowed by address and port and cannot distinguish a normal web request from an attack, since both arrive as HTTP on the same port. A WAF reads the content of HTTP requests, the URL, headers and body, and blocks those matching attack patterns. Sites typically need both.
Does Cloudflare have a WAF?
Yes. Cloudflare's WAF, available on its paid plans with basic protections on the free tier, includes managed rule sets maintained by Cloudflare, the OWASP core rules, custom rules, rate limiting and bot management, all applied at its edge before traffic reaches your server. It is the most common way small and medium sites get a WAF.
Can a WAF block legitimate users?
Yes, through false positives: comments containing code, searches with unusual characters, rich-text form submissions and some API requests can match attack rules and be blocked with a 403. Start in logging mode, tune or exempt rules for affected paths, then enforce, and review the event log regularly to catch blocked crawlers, webhooks and clients.
Does a WAF make my website secure?
It reduces exposure and stops most opportunistic and automated attacks, and managed rules protect against newly disclosed vulnerabilities before you patch. It does not fix flaws in the application, understand business-logic abuse, or protect against stolen credentials. Secure code, patched dependencies, HTTPS, security headers and backups remain necessary alongside it.
