Web Application Firewall (WAF)
A Web Application Firewall (WAF) is a security control that filters, monitors, and blocks HTTP/HTTPS traffic to and from a web application, protecting it from attacks such as SQL injection and cross-site scripting.
Definition
A Web Application Firewall (WAF) is a security control that filters, monitors, and blocks HTTP/HTTPS traffic to and from a web application, protecting it from attacks such as SQL injection and cross-site scripting.
Overview
Unlike a traditional network Firewall, which filters traffic based on IP addresses and ports, a WAF operates at the application layer (Layer 7) and inspects the actual content of HTTP requests — form fields, headers, cookies, and URL parameters — for patterns associated with known attack techniques. This makes it purpose-built to defend against web-specific threats rather than general network intrusions. A WAF is typically deployed based on rule sets aligned with the OWASP Top 10, the industry-standard list of the most critical web application security risks, including SQL Injection, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF). Rules can operate in a blocklist mode (blocking known-bad patterns) or an allowlist mode (permitting only expected, validated input), with modern WAFs increasingly using machine learning to adapt to an application's normal traffic patterns and flag anomalies. WAFs are commonly delivered as a cloud service positioned in front of an application — through providers such as Palo Alto Networks, Fortinet, or as an add-on to a CDN — as a reverse proxy appliance, or as a plugin embedded directly in the web server. Cloud-delivered WAFs are popular because they can be enabled quickly without changing application code, and they benefit from threat intelligence shared across the provider's entire customer base. A WAF is considered a compensating control rather than a substitute for secure coding practices: it can block many exploitation attempts in real time, buying developers time to patch an underlying vulnerability, but it does not fix the vulnerable code itself. For this reason, WAFs are typically deployed as one layer of a broader defense-in-depth strategy that includes secure development practices and regular Vulnerability Assessment.
Key Features
- Inspects HTTP/HTTPS traffic at the application layer, not just IP/port level
- Rule sets commonly aligned with the OWASP Top 10 risk categories
- Blocks common attacks including SQL injection, XSS, and CSRF
- Can operate in blocklist or allowlist enforcement mode
- Increasingly uses machine learning to detect anomalous traffic patterns
- Deployable as a cloud service, reverse proxy, or embedded plugin
- Acts as a compensating control alongside secure coding practices