What Is WAF

A WAF (Web Application Firewall) is a security product that inspects HTTP/HTTPS traffic to a web application and detects or blocks malicious requests. A traditional firewall controls IP addresses and port numbers at the network layer (L3/L4); a WAF analyses the contents of the HTTP request at the application layer (L7).

Its strength lies in attacks whose traces appear in the syntax of the request itself, such as XSS, SQL injection and directory traversal. In terms of the 2025 edition of the OWASP Top 10, part of Injection (A05:2025) falls into this category. Problems that cannot be told apart from normal traffic by looking at a single request - such as Broken Access Control (A01:2025), placed at the top of that list, or Insecure Design (A06:2025) - are outside what a WAF can decide. CSRF requests also look legitimate on the wire, so token validation and other application-side measures do the real work and the WAF only assists. A WAF is a mitigation layer, not a substitute for fixing the vulnerability in the application itself.

WAF Detection Methods

Signature-based (blacklist): Detects requests by matching them against known attack patterns (signatures), looking for strings such as SELECT * FROM or <script> inside the request. Detection rates against known attacks are high, but it is weak against unknown attacks and against obfuscation crafted to slip past the signatures.
Whitelist: Defines the patterns of legitimate requests and blocks everything else. It can cope with unknown attacks, but an incomplete definition of what is legitimate produces a flood of false positives. This works well where the input format is strictly defined, as with an API.
Scoring: Adds up how far a request violates multiple rules as a score and blocks it once the score crosses a threshold, which allows flexible handling of grey-zone attacks that no single rule can judge. The Anomaly Scoring Mode of the OWASP Core Rule Set (CRS) works this way: each individual rule only detects and adds to the score, and whether to block is decided together once every rule has been evaluated.
Machine-learning based: Learns normal traffic patterns and flags deviating requests as anomalies. It may catch unknown attacks, but it depends on the quality of the training data and false positives are hard to tune out.

WAF Deployment Models

WAFs fall into three categories by how they are deployed.

Cloud WAF: Requests are received on the provider's network and then forwarded to the origin. One form points DNS at a reverse proxy (as with the Cloudflare WAF), and another associates the WAF with a CDN or load balancer (as with AWS WAF). You can start without buying dedicated hardware, and it is often offered together with DDoS attack protection.
Appliance: Dedicated hardware installed on your network. It offers high throughput and fine-grained customisation, but the up-front cost is high and operating it requires specialist knowledge. Aimed at large enterprises.
Software (host-based): Installed on the web server as a module. ModSecurity, maintained by OWASP, is the best-known example and as of August 2026 is still developed as open source under the Apache License 2.0. It is free to use, but writing and tuning rules demands a high level of expertise.

A cloud WAF suits small sites, while an appliance suits large environments that need fine-grained control. If your traffic already passes through a CDN or load balancer, you can associate a WAF there and apply it without touching the origin server - but the work of isolating false positives afterwards and tuning the rules remains exactly the same.

Practical WAF Operation Tips

A WAF is not something you deploy and forget; continuous tuning is essential.

Managing false positives: False positives are the single biggest operational issue with a WAF. When a legitimate request is blocked, the damage to user experience is immediate. Run it in detection mode (logging only) rather than blocking mode at first, learn the false-positive patterns, and only then switch to blocking.
Updating rules regularly: Attack techniques evolve daily, so even when you use a managed rule set you need to review new rules and the effectiveness of existing ones periodically.
Use as a virtual patch: For the period until a fixed version ships or your own change lands, you use the WAF to stop requests that exploit that specific vulnerability. It is also used as a first response to a zero-day attack, but it buys time until the permanent fix - if the attacker rewrites the request, it slips through. It does not replace the fix itself.
Log analysis: WAF logs are indispensable when investigating a security incident. Analyse the patterns of blocked requests to understand which attacks you are seeing.
Combining with CSP: A WAF filters requests on the server side, whereas CSP restricts script execution in the browser. Combining the two gives you defence in depth against XSS.

A WAF does not fix the underlying vulnerabilities in your application. Rather than relying on it alone, use it alongside application-side measures such as secure coding, input validation and parameterised queries.

Common Misconceptions

Deploying a WAF completes web application vulnerability countermeasures: A WAF mitigates known attack patterns, but the vulnerability in the application itself is still there. Techniques for evading WAF rules also exist, so fixing the underlying vulnerability and secure coding remain essential.
A WAF can prevent all web attacks: Attacks that cannot be distinguished from legitimate requests - abuse of business logic (manipulating discounts, privilege escalation) or theft of credentials through phishing - cannot be detected by a WAF. What a WAF is good at is spotting syntactically abnormal requests such as SQL injection or XSS.

Cloud WAF vs. Appliance WAF Comparison

Cloud WAF

Deployed by switching DNS or by associating it with a CDN or load balancer. No dedicated hardware is needed, so up-front cost stays low, and it is often bundled with DDoS protection. Managed rules keep the operational load light. However, how much you can customise depends on the vendor, and usage-based pricing tied to traffic volume can push costs up.

Appliance WAF

Installed inside your own network. Offers high throughput and fine-grained rule customisation. However, the up-front cost is high and writing and tuning rules requires specialist knowledge. You are also responsible for maintaining and refreshing the hardware yourself.

WAF (Web Application Firewall)