WAF (web application firewall)

How does a WAF work?

A web application firewall (WAF) inspects each web request and applies a set of rules before the request is allowed through. OWASP says a WAF applies rules to each HTTP exchange, covering common attacks such as cross-site scripting and SQL injection. It sits in front of a specific web application and can act as a reverse proxy.

Modern services bundle several rule types. Cloudflare’s WAF offers managed rulesets that Cloudflare maintains, custom rules you write yourself, and rate limiting rules that cap how often a client can make matching requests. Cloudflare says its WAF is available on all plans, though free plans get only the Free Managed Ruleset and one rate limiting rule.

Why does a WAF matter for a small business?

A WAF gives you a chance to block a known attack pattern while you fix the underlying software. It is not a replacement for updates. OWASP notes that adapting a WAF to an application can take significant effort and needs maintaining as the application changes.

Use one to rate limit logins and slow scrapers. See how to block AI crawlers for crawler rules, and the website weak-spot check to find what a WAF cannot cover.