What Is a Web Application Firewall (WAF)?
On this page
A web application firewall (WAF) filters HTTP traffic to block common web attacks before they reach your application. Where a network firewall works at the level of ports and IPs, a WAF understands HTTP — inspecting requests for SQL injection, XSS, and other patterns. It is a useful layer, and a dangerous thing to over-trust.
What does a WAF catch?#
Sitting in front of the app as a reverse proxy, a WAF inspects each request against rules:
| Catches well | Struggles with |
|---|---|
| Known injection/XSS patterns | Novel or heavily obfuscated payloads |
| Common scanner traffic | Business-logic abuse |
| Bad bots, some rate abuse | Anything unique to your app |
| Virtual patching of known CVEs | Encrypted/opaque content it can’t parse |
That “virtual patching” ability is genuinely valuable: when a vulnerability is disclosed, a WAF rule can block exploitation while you develop and deploy the real fix.
Why is a WAF only a layer?#
Because it matches patterns, and patterns can be evaded. Attackers routinely bypass WAFs with encoding tricks and novel payloads, and a WAF has no idea what your application’s business rules are — it cannot catch logic flaws or broken access control. It reduces noise and buys time; it does not fix vulnerable code.
The WAF is the web-aware member of the firewall family. More at the Network Security hub.
Frequently asked questions#
What does a web application firewall do?
A WAF inspects HTTP requests and responses and blocks those matching known attack patterns — SQL injection, cross-site scripting, and other common web threats. It sits in front of a web application, usually as a reverse proxy, filtering malicious traffic before it reaches the application code, and can also enforce rate limits and virtual patches.
Can a WAF replace secure coding?
No. A WAF is a valuable layer but it works on patterns and can be bypassed with novel or obfuscated payloads. It cannot understand your application’s business logic or fix the underlying vulnerability. Treat a WAF as defense in depth and a way to buy time (virtual patching), never as a substitute for fixing the code.