Suggest an editImprove this articleRefine the answer for “What is WAF?”. Your changes go to moderation before they’re published.Approval requiredContentWhat you’re changing🇺🇸EN🇺🇦UAPreviewTitle (EN)Short answer (EN)**WAF (Web Application Firewall)** is a firewall for web applications that protects sites and APIs from Layer 7 (application layer) attacks. **Key point:** a WAF is an additional layer of defense, not a "silver bullet" that replaces secure code.Shown above the full answer for quick recall.Answer (EN)Image**WAF (Web Application Firewall)** is a **firewall for web applications** that **protects sites and APIs from Layer 7 (application layer) attacks**. In simple terms: *a WAF sits in front of the web application and filters HTTP/HTTPS requests, blocking the malicious ones.* --- ## Why WAF is needed A regular firewall (L3/L4): - sees IPs, ports, protocols; - **does not understand** what happens inside an HTTP request. WAF is needed to: - protect web applications from logical attacks; - block attacks that look like "normal" traffic; - reduce the risk of data leaks and site breaches. **If there is a web application, a WAF is almost mandatory.** --- ## What attacks WAF protects against WAF primarily protects against **L7 attacks**, such as: - SQL Injection; - XSS (Cross-Site Scripting); - CSRF; - HTTP Flood (L7 DDoS); - brute force and credential stuffing; - file inclusion and command injection. --- ## How WAF works WAF analyzes the **content of HTTP/HTTPS requests**: - the URL; - the headers; - the parameters; - the request body. And makes a decision: - **allow** the request; - **block** the request; - **log** the event. It often works based on: - attack signatures; - rules; - behavioral analysis. --- ## Where WAF is deployed WAF can be: - hardware (a physical appliance); - software; - cloud-based (between the user and the site); - built into a reverse proxy or CDN. --- ## WAF operating modes ### 1. Detection (monitoring) - only detects attacks; - blocks nothing. Used for testing. --- ### 2. Prevention (blocking) - automatically blocks malicious requests. The main operating mode. --- ## Limitations of WAF It is important to understand: - WAF **does not replace secure coding**; - incorrect configuration can block legitimate traffic; - it does not protect against all types of attacks (for example, an application's logical flaws). WAF is an **additional layer of defense**, not a "silver bullet."For the reviewerNote to the moderator (optional)Visible only to the moderator. Helps review go faster.