What is Web Application Firewall (WAF)?

What it does

A WAF inspects every HTTP and HTTPS request before it reaches the web application. It compares requests against a ruleset and blocks or flags those that look malicious. Core functions include:

• Blocking SQL injection and cross-site scripting (XSS) payloads
• Enforcing allow-lists or deny-lists on request parameters, headers, and cookies
• Rate-limiting requests from a single IP address
• Logging and alerting on suspicious traffic patterns
• Applying virtual patches for known vulnerabilities before code fixes are deployed

Some WAFs use signature-based detection. Others add machine learning or semantic analysis to catch novel attack variants that signatures miss. A WAF can be deployed as a reverse proxy, a network appliance, a module inside a web server, or a cloud service.

Why teams buy it

Teams buy a WAF to reduce the window of exposure between discovering a vulnerability and shipping a fix. A virtual patch in the WAF can block exploitation of a known flaw in hours, while a code fix may take weeks. Compliance frameworks such as PCI DSS require a WAF or equivalent control for any system that handles payment card data. Teams also use WAFs to get visibility into attack traffic targeting their applications.

What to look for

• Detection method: Signature-only WAFs miss zero-day variants. Look for semantic analysis or ML-based detection alongside signatures.
• False positive rate: Overly aggressive rules block legitimate users. Ask vendors for tuning workflows and test results.
• Deployment model: On-premises appliance, cloud-delivered, or embedded module. Match the model to your architecture.
• Virtual patching: The ability to write a custom rule quickly when a CVE drops.