What is WAF?

1 min read Updated 2026-02-05

Web Application Firewall. A security solution that monitors and filters HTTP traffic between a web application and the internet, blocking common attacks like XSS and SQL injection.

Related: XSS SQL Injection DDoS

Understanding WAF

WAFs inspect HTTP requests and responses to block malicious traffic. They use rules, signatures, and increasingly machine learning to detect attacks. While not a replacement for secure coding, WAFs provide an additional layer of defense and can virtually patch vulnerabilities.

Examples

  • Cloudflare WAF blocking SQL injection attempts
  • AWS WAF protecting API Gateway endpoints
  • ModSecurity with OWASP Core Rule Set
  • Blocking requests with known attack patterns

How to Prevent

  • Deploy a WAF in front of web applications
  • Keep WAF rules updated
  • Monitor WAF logs for attack patterns
  • Use WAF in conjunction with secure coding practices
  • Test WAF rules to avoid blocking legitimate traffic

Worried about WAF in your app?

Our security audits identify vulnerabilities like this before attackers do. Get expert manual review of your codebase.

Get a Security Audit Back to Glossary