Term · Security & infrastructure
WAF (web application firewall)
A WAF — web application firewall — sits between visitors and your website and inspects web requests, blocking those that match attack patterns: SQL injection, cross-site scripting, attempts to exploit known vulnerabilities, suspicious bots and abusive request rates.
[ 01 ]
Explained
How it works
- Managed rule sets detect common attack patterns and known exploits, updated by the provider.
- Custom rules block or challenge traffic by path, country, IP reputation, headers or behaviour.
- Rate limiting restricts how often a source can hit sensitive endpoints such as logins and forms.
- Bot management distinguishes legitimate crawlers from abusive bots.
WAFs are offered by CDN and security providers, hosting platforms, or as software on your server.
What it does not do
A WAF reduces risk but does not replace secure development and updates. Vulnerable code or outdated plugins remain vulnerable; the WAF may block known exploit patterns, but not every attack. See CMS security basics.
Tuning
- Start in monitoring mode to see what would be blocked.
- Watch for false positives, especially on forms, admin areas and APIs.
- Add exceptions carefully and narrowly.
- Review logs after changes and during incidents.
[ 02 ]
FAQ
Frequently asked questions
Do small websites need a WAF?
A basic WAF from a CDN provider is inexpensive and blocks a lot of automated attack traffic. It is a worthwhile layer.
Can a WAF slow down the site?
Negligibly when run at a CDN edge. Misconfigured rules that block legitimate users are the bigger risk.