WAF

What it means

A WAF, web application firewall, is a security solution that protects web applications, websites, online stores and APIs by inspecting incoming requests and blocking those that look like attacks. Unlike a classic network firewall, which filters traffic by address and port, a WAF understands the content of HTTP requests.

A WAF recognises typical attacks on web applications, such as injecting malicious SQL code into a form, injecting scripts into pages, attempts to reach files outside the website, brute-force login attacks, or automated bots that scrape content or test stolen passwords. It uses rule sets and often behavioural analysis.

A WAF can run as a cloud service, often as part of a CDN, as a module on the web server or as a separate appliance. Cloud solutions usually also protect against some types of DDoS attack, as they absorb the load before it reaches the company's server.

How it works in practice

For a company with an online store, a client portal or forms that process personal data, a WAF is one of the most effective layers of protection. It stops a large share of automated attacks constantly probing known vulnerabilities in popular content management systems and plugins, and buys time until a patch is installed.

Deployment starts in monitoring mode, where the WAF only logs suspicious requests. Once the rules are tuned so as not to block legitimate users, it is switched to blocking mode. Logs must be watched, false positives dealt with and rules updated continuously, because attackers change their methods.

A WAF does not replace secure development and updates. It is an extra protective layer that helps but does not fix flaws in the application itself. We recommend combining it with regular penetration testing, updates and least-privilege access to administration.

What to watch out for

The most common mistake is leaving the WAF on default settings with no further care. Overly strict rules can block customers or payment gateways without the company knowing; overly loose ones let attacks through. Rules should be tailored to the specific application and results monitored.

Beware of the WAF being bypassed. If the server is reachable directly, not only through the WAF, an attacker can get around the protection. The server should accept traffic only from the WAF or CDN. When migrating a site or changing DNS, check that protection still works and that the origin server addresses have not been exposed.