A web application firewall (WAF) is an application firewall for HTTP. It applies a set of rules to web requests and blocks those that look like common attacks, such as cross-site scripting and SQL injection. It protects a specific application as a reverse proxy would, but it cannot fix the flaw in the code behind it.
What is a WAF, formally?
OWASP defines a WAF as an application firewall for HTTP applications that applies a set of rules to an HTTP conversation. Generally, the rules cover common attacks such as cross-site scripting and SQL injection. While proxies generally protect clients, WAFs protect servers, and a WAF can be considered a reverse proxy. It may come as an appliance, a server plugin or a filter, and can be customized to an application, although OWASP warns that the effort to customize can be significant and must be maintained as the application changes.
That last point is the one buyers underestimate. A WAF is not a box you install once.
What does it do well?
- Blocks known attack patterns. The OWASP Core Rule Set (CRS) is a free set of generic attack detection rules for ModSecurity or compatible WAFs. Its stated aim is to protect against a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.
- Buys time. When a new vulnerability is announced and a patch is days away, a rule for the exploit pattern can reduce exposure.
- Adds visibility. Logs show what is being tried against you.
- Gives a single enforcement point. Useful when many applications are old and nobody can edit them.
What does it miss?
A constructed example: an online store has an endpoint GET /invoices/8841. A user changes the number to 8842 and receives another customer's invoice. The request is well formed, uses a valid session and carries no attack string. A WAF has nothing to match. Fixing it requires an ownership check in the application.
Typical misses:
- Authorization flaws. Requests that are valid in form and wrong in meaning.
- Business logic abuse. Coupon reuse, price tampering, automated purchasing.
- Slow and quiet abuse. Low volume credential stuffing that stays under rate limits.
- Encrypted or unusual formats. Payloads the WAF cannot parse correctly.
- Bypass techniques. Attackers encode input in ways that a rule does not expect. Project maintainers publish bypass reports for this reason.
- Anything not routed through it. A forgotten host name or direct origin address.
What are detection mode and blocking mode?
Most WAFs can run in a mode that only logs matches, and in one that blocks them. Start with logging. Review what would have been blocked for a few weeks, find false positives, such as a legitimate form field that looks like SQL, then add exceptions and move to blocking. Skipping this step is how a WAF takes a checkout page offline on launch day.
Plan for continuing work: new application features create new traffic patterns, and rules need revisiting after each major release.
Does a compliance standard require one?
Some do, in part. PCI DSS version 4.0 has a requirement for public-facing web applications that asks for either regular assessments or an automated technical solution that detects and prevents web-based attacks. Many organizations meet it with a WAF. Read the current text and talk to your assessor, since the details and the evidence they expect matter.
How to check or apply this
- List every public web application and confirm all traffic reaches it only through the WAF, including the origin address being locked down.
- Start in log-only mode with a maintained rule set, such as the OWASP CRS.
- Review matches weekly, fix false positives, then enable blocking in stages.
- Keep ownership and authorization checks in application code, and test them.
- Add rate limits and bot controls for login, signup and checkout.
- Re-tune after each major release and review logs for repeated probes.
Quick check
Can a WAF replace patching?
No. It can reduce exposure while you patch, but a bypass or a request that skips the WAF still reaches the vulnerable code.
Is a WAF the same as a network firewall?
No. A network firewall filters by address, port and connection state. A WAF reads HTTP requests and responses and applies rules to their content.
Sources
- OWASP, Web Application Firewall
- OWASP CRS, Core Rule Set
- PCI Security Standards Council document library
Last reviewed: 18 October 2026.
