What is WAF?

A Web Application Firewall (WAF) is a security appliance, software plugin, or cloud service that inspects HTTP and HTTPS traffic between a client and a web application. Its primary purpose is to detect and block malicious requests that exploit application-layer vulnerabilities, such as SQL injection (SQLi), cross-site scripting (XSS), cross-site request forgery (CSRF), and file inclusion attacks. Unlike a network firewall that operates at layers 3 and 4 of the OSI model, a WAF works at layer 7 (the application layer), allowing it to parse and understand the structure of HTTP requests and responses.

The WAF operates based on a set of rules, often called policies, which define what constitutes malicious traffic. These rules can be signature-based, matching known attack patterns, or anomaly-based, detecting deviations from normal traffic baselines. Many modern WAFs also use positive security models, where only explicitly allowed traffic is permitted, and negative security models, where known attack patterns are blocked. The WAF can be deployed in-line (proxying traffic) or out-of-band (receiving mirrored traffic), with in-line being the most common for active blocking. Cloud-based WAFs, such as those provided by AWS (AWS WAF), Cloudflare, and Akamai, are popular because they require no hardware and can scale with traffic.

In the wider security stack, a WAF complements other controls like intrusion prevention systems (IPS), DDoS protection, and API gateways. It is not a substitute for secure coding practices but provides a critical layer of defense, especially for legacy applications or those exposed to the public internet. The Open Web Application Security Project (OWASP) publishes the OWASP Top 10, a widely referenced list of the most critical web application security risks, which WAFs are designed to mitigate. WAFs are also a common requirement for compliance frameworks such as PCI DSS, which mandates their use for protecting cardholder data.