Protect your digital apps at scale

A web application firewall (WAF) is a network-based security control that filters, monitors, and blocks malicious HTTP/HTTPS traffic to protect web applications from common attacks like SQL injection (SQLi), command injection, cross-site scripting (XSS), cross-site request forgery, and server-side request forgery (SSRF). Regulations and security standards, such as PCI DSS, often require protection for public-facing web applications. WAF can be used as an effective security control to achieve compliance depending on the organization's environments and scopes.

A WAF inspects inbound and outbound layer 7 application/web traffic that typically runs over the HTTP/HTTPS protocol. WAFs apply security rules, or policies, and threat detection to identify malicious requests and well-known attack patterns. They can also block web application attacks to protect web applications in real time. Some organizations opt to deploy WAFs in detect-only, alerting, or monitoring mode so they don't inadvertently impact legitimate production usage. However, this is frequently a byproduct of inadequate tuning, false positive rates, or WAF efficacy concerns.

Traditional firewalls and next-generation firewalls (NGFW) focus on ports, IP addresses, and multiple network protocols. These foundational security controls are useful for protecting all types of network traffic, but they provide broad-spectrum protection which translates to less efficacy on HTTP/HTTPS specifically. Rules may be too generalized and only address basic web application attack patterns. A WAF focuses specifically on application-layer (L7) threats, protecting web applications from all types of application threats and OWASP Top 10 risks.

APIs typically communicate over the same HTTP/HTTPS protocol as web applications, inheriting a base level of protection. However, not all WAFs are engineered to understand API context like gRPC, GraphQL, and REST. Many modern WAF solutions include API-specific protections as part of a broader WAAP (Web Application and API Protection) platform, helping detect API abuse, API schema violations, and authorization attacks on API endpoints.

Web Application and API Protection (WAAP) platforms typically combine WAF, API discovery, API testing, API protection, bot & abuse protection, and denial-of-service (DoS) mitigation into a unified application runtime security platform that can detect and stop all types of application-layer (L7) attacks.

Cloud WAF is often easier to deploy and scale for modern system designs, delivered as SaaS or attached to a content delivery network (CDN). Appliance or on-premises WAF are often used to satisfy strict data residency requirements or where legacy technology stacks inhibit the use of cloud compute. The best WAF choice often depends on factors like availability thresholds, latency tolerances, regulatory mandates, and operational requirements. Some organizations, particularly in heavily regulated industries, employ both.

The OWASP Top 10 is a widely used list of common web application security risks. A WAF helps reduce exposure to many of these risks by blocking exploit patterns and enforcing application-layer security controls. However, full coverage of the OWASP Top 10 and the adjacent OWASP API Security Top 10 risks requires a WAAP platform.

A WAF can run at the edge via SaaS-delivery or CDN, in-line as a reverse proxy or integration with other proxies like API gateways, or within microservice environments like Kubernetes — attached to an ingress controller or as a sidecar container. A common pattern is to deploy WAF at the edge for broad coverage with universal protection policies, then deploy an inner WAF for greater control over internal service calls or granular policy requirements.

A properly tuned WAF adds minimal latency, and the security benefits greatly outweigh any potential availability impacts. WAF deployed at the edge as a cloud service or with CDN is highly scalable and can actually improve application performance by absorbing attacks, caching content, and reducing load on origin web and application servers.

WAF rules or policies define what traffic to allow, challenge, or block. Rules consist of expected behaviors, schemas, and parameters (positive security) or known-malicious attack patterns (negative security). Many WAF configurations use a mix of both. Managed rulesets are prebuilt, regularly updated security rules that protect against known exploits, OWASP Top 10 attack patterns, and emerging threats. The OWASP Core Rule Set (CRS) is often the foundation of such managed rulesets.