A WAF (Web Application Firewall) is an optional but important security component for web applications. It helps filter out dangerous requests before they reach the web server and provides an element of protection against malicious traffic.
What a WAF Does
A WAF sits between the public internet and your web server. It inspects incoming HTTP/HTTPS requests and blocks or flags those that match known attack patterns.
Internet
|
v
+----------+
| WAF | <-- Filters dangerous requests
+----------+
|
v (only clean traffic passes)
+----------+
| Web |
| Server |
+----------+
|
v
+----------+
| App |
| Database |
+----------+
Without a WAF, all requests — both legitimate and malicious — go directly to your web server. The WAF acts as a gatekeeper that inspects each request before it can do damage.
What a WAF Protects Against
A WAF is specifically designed to protect the application layer (Layer 7) of the network stack. Common threats it defends against include:
| Attack | Description |
|---|---|
| SQL Injection | Malicious SQL code injected into form inputs to manipulate the database |
| Cross-Site Scripting (XSS) | Injecting malicious scripts into pages viewed by other users |
| Cross-Site Request Forgery (CSRF) | Tricking users into submitting requests they did not intend |
| DDoS (Application Layer) | Flooding the application with requests to exhaust resources |
| Bot traffic | Automated scrapers, credential stuffing, and spam |
WAF in the Web Application Architecture
A WAF is typically placed at the edge of the infrastructure, before traffic reaches the application servers.
+------------------+
| User Browser |
+--------+---------+
|
| HTTPS request
v
+--------+---------+
| WAF |
| |
| Rule engine |
| Threat detection|
| Rate limiting |
+--------+---------+
|
| Clean traffic only
v
+--------+---------+
| Load Balancer |
+--------+---------+
|
+----+----+
| |
+---+---+ +---+---+
| App | | App |
| Server| | Server|
+-------+ +-------+
WAF Rule Types
WAFs operate using rules that define what traffic to allow or block. These rules fall into two main categories:
Blocklist (Negative Security Model) — blocks known bad patterns. Easy to set up, but requires constant updates as new attack patterns emerge.
Allowlist (Positive Security Model) — only allows known-good traffic patterns. More secure but requires more configuration and maintenance.
Most production WAFs use a combination of both, along with machine learning to detect anomalies.
Managed vs. Self-Hosted WAF
| Type | Description | Example |
|---|---|---|
| Cloud/Managed WAF | Provided as a service, minimal setup | AWS WAF, Cloudflare WAF |
| Self-Hosted WAF | Deployed on your own infrastructure | ModSecurity, NGINX WAF |
| Integrated WAF | Built into a CDN or load balancer | Azure Front Door, Akamai |
Summary
A WAF is a critical layer of defence for any web application exposed to the internet. While it does not replace secure coding practices, it provides an additional barrier against common attacks and gives teams time to respond to new threats.
A WAF is not a replacement for secure code — it is an extra layer of defence that reduces your attack surface.