Web Application Firewall (WAF)

Security+ 🏆 • Web Security 🕸️ • Network Security 🌐 • Difficulty: premium

Definition

A Web Application Firewall is a security control that monitors and filters HTTP and HTTPS traffic to and from a web application in order to detect and block common web attacks. A WAF helps protect applications from threats like injection and malicious requests, especially when placed in front of public-facing web services.

Examples

  • A WAF blocks requests that match common SQL injection patterns targeting a login form.
  • An organization uses a WAF to apply rate limiting to reduce brute force attempts against an API endpoint.

Discover 🔎

Web applications are exposed to the internet and accept untrusted input by design. That makes them attractive targets. A WAF adds a protective layer in front of a web application by inspecting web traffic and stopping requests that look malicious. It is not a replacement for secure coding, but it can reduce risk, buy time during urgent vulnerabilities, and provide useful visibility into attack attempts.

Remember: A WAF protects web traffic. It can help block common web attacks, but it cannot fix vulnerable code. It is a layer, not the foundation.
Open the interactive lesson Browse more topics

Tip: The interactive version includes progress tracking, decks, and premium deep dives.