What is WAF?

WAF (Web Application Firewall) is a firewall for web applications that protects sites and APIs from Layer 7 (application layer) attacks.

In simple terms: a WAF sits in front of the web application and filters HTTP/HTTPS requests, blocking the malicious ones.

---

#Why WAF is needed

A regular firewall (L3/L4):

• sees IPs, ports, protocols;
• does not understand what happens inside an HTTP request.

WAF is needed to:

• protect web applications from logical attacks;
• block attacks that look like "normal" traffic;
• reduce the risk of data leaks and site breaches.

If there is a web application, a WAF is almost mandatory.

---

#What attacks WAF protects against

WAF primarily protects against L7 attacks, such as:

• SQL Injection;
• XSS (Cross-Site Scripting);
• CSRF;
• HTTP Flood (L7 DDoS);
• brute force and credential stuffing;
• file inclusion and command injection.

---

#How WAF works

WAF analyzes the content of HTTP/HTTPS requests:

• the URL;
• the headers;
• the parameters;
• the request body.

And makes a decision:

• allow the request;
• block the request;
• log the event.

It often works based on:

• attack signatures;
• rules;
• behavioral analysis.

---

#Where WAF is deployed

WAF can be:

• hardware (a physical appliance);
• software;
• cloud-based (between the user and the site);
• built into a reverse proxy or CDN.

---

#WAF operating modes

#1. Detection (monitoring)

• only detects attacks;
• blocks nothing.

Used for testing.

---

#2. Prevention (blocking)

• automatically blocks malicious requests.

The main operating mode.

---

#Limitations of WAF

It is important to understand:

• WAF does not replace secure coding;
• incorrect configuration can block legitimate traffic;
• it does not protect against all types of attacks (for example, an application's logical flaws).

WAF is an additional layer of defense, not a "silver bullet."