What is WAF?

TL;DR — what is a WAF and how does it work

A WAF (Web Application Firewall) is an HTTP/HTTPS traffic filter that protects web applications against application-layer (OSI L7) attacks: SQLi, XSS, CSRF, RFI/LFI, bot attacks, HTTP flood DDoS, and OWASP Top 10. It works as a reverse proxy between the client and the application — it analyses payload, headers, cookies, URL parameters, and blocks malicious requests before they reach the origin server.

• Deployment types: cloud WAF (Cloudflare, AWS WAF, Akamai App & API Protector), appliance/network WAF (F5 BIG-IP ASM, Imperva SecureSphere), host-based WAF (ModSecurity + OWASP CRS, NAXSI).
• Operating modes: positive security (whitelist), negative security (blacklist + signatures), hybrid + ML/behavioural scoring.
• Regulatory requirement: PCI DSS 4.0 Req 6.4.1 (mandatory for applications with cardholder data), NIS2 Art. 21, DORA Art. 9, ISO 27001:2022 A.8.23/A.8.26.
• Paired with DDoS protection: WAF protects L7 (HTTP flood, Slowloris), scrubbing protects L3-4 (SYN flood, UDP amplification) — usually deployed together; see DDoS.

Definition

WAF — WAF (Web Application Firewall) is an application-layer firewall that protects web applications from attacks such as SQL injection, cross-site scripting (XSS), CSRF, and other OWASP Top 10 threats.

Explore our services

• Penetration testing

WAF vs firewall vs NGFW vs RASP vs API Gateway — comparing defence layers

	Traditional Firewall (L3-4)	NGFW (L3-7)	WAF (L7 web only)	RASP (in-app)	API Gateway / API Security
OSI layer	3-4 (Network/Transport)	3-7 (application classification)	7 (Application, HTTP semantics)	7 (in-process, runtime)	7 (API-specific)
What it protects	Network, ports, hosts	Network + application (DPI)	Web application HTTP/HTTPS	Application from inside (process context)	REST/GraphQL/gRPC APIs
Block decision	IP, port, protocol	IP + DPI + IDS/IPS signatures	HTTP semantics, payload, headers	Runtime context (DB query, file read, eval)	API schema, rate limit, auth, BOLA/BFLA
Examples	iptables, Cisco ASA, pfSense	Palo Alto PA-Series, Fortinet FortiGate, Check Point	Cloudflare WAF, AWS WAF, ModSecurity	Contrast Protect, Imperva RASP, Sqreen	Salt Security, Noname, Wallarm, Traceable, Kong
Defends against	Port scans, network reconnaissance, simple L3-4 DDoS	All firewall + IDS/IPS, malware C2	OWASP Top 10, bots, HTTP flood, scrapers	Zero-days, in-app exploits, deserialisation	API abuse, BOLA, BFLA, schema violations, scope escalation
Visibility into app logic	None	Minimal	Medium (HTTP layer)	Full (process internals)	Full at the API layer
Typical deployment	Network edge, VLAN segmentation	Edge + between segments	Reverse proxy in front of app	Agent in app runtime	In front of API backend (Mulesoft, Kong, AWS API Gateway)

WAF architecture

A WAF operates in reverse proxy mode: client traffic (HTTPS) first reaches the WAF, which terminates TLS, decrypts the payload, inspects plaintext HTTP, and makes an allow/block/challenge decision before forwarding to the origin server. From the client’s perspective the WAF is invisible — the application’s DNS record points to the WAF/CDN edge (Cloudflare Anycast IP), not to the origin.

Deployment modes

• Inline / blocking mode — the WAF blocks malicious requests in real time, returning 403/406/451 for blocked traffic. Standard production mode.
• Out-of-band / monitoring mode — the WAF analyses a copy of the traffic (port mirroring, sFlow) without actively blocking — used at the start of a deployment to gather data and calibrate rules without false positives.
• TAP mode (passive) — the WAF only observes; used for audit and forensics.
• Learning mode — the WAF builds a baseline traffic profile (typically 7-30 days), then switches to enforcement; standard with positive-security WAFs.

Deployment topologies

• Cloud WAF (Anycast, CDN-integrated) — Cloudflare, AWS WAF + CloudFront, Akamai, Fastly Signal Sciences. Anycast routing forwards traffic to the nearest PoP (>300 locations at Cloudflare), eliminates a single point of failure, and adds DDoS protection in the same package. The dominant model in 2026 for most web applications.
• Appliance WAF (rack-mounted, on-prem) — F5 BIG-IP ASM, Imperva SecureSphere, A10 Thunder ADC. Chosen by regulated industries (some banks, defence sector) that need full hardware control and isolation from public cloud.
• Host-based WAF — ModSecurity (Apache/Nginx/IIS module), NAXSI (Nginx, whitelist-only). Open source, deployed directly on the application server.
• Container WAF / Service Mesh — Envoy/Istio with WAF policy (e.g. Coraza WAF as an Envoy filter), sidecar deployment in Kubernetes. For microservices and cloud-native platforms.
• Edge WAF (serverless) — Cloudflare Workers, AWS Lambda@Edge, Fastly Compute@Edge. Custom WAF logic in JavaScript/Rust/Wasm executed at the edge.

How a WAF detects attacks — detection engines

A modern WAF does not rely on a single mechanism — it combines 5-7 engines running in parallel, each with its own scoring.

• Signature-based detection — the OWASP Core Rule Set (CRS) contains ~250 rules covering SQLi, XSS, RFI/LFI, command injection, and scanner detection. Rules have a severity (CRITICAL/ERROR/WARNING/NOTICE) and contribute to a cumulative anomaly score; the blocking threshold is typically 5 (paranoia level 1) or lower.
• Behavioural / anomaly detection — ML scoring based on a baseline of traffic; requests deviating substantially from the norm are flagged. Cloudflare ML Bot Detection, Akamai Bot Manager, AWS WAF Fraud Control.
• Reputation feeds — lists of known malicious IPs (TOR exit nodes, known botnets, abused residential proxies, ASN-based blocking for 100% malicious ASNs). Cloudflare uses data aggregated from 30M+ domains.
• Bot detection — JavaScript challenge (checks whether the client executes JS like a browser), CAPTCHA/hCaptcha (Turing test), browser fingerprinting (canvas, fonts, WebGL), TLS fingerprinting (JA3/JA4), mouse movement and timing analysis.
• Rate limiting — per IP, per session, per cookie, per endpoint, per JA3 fingerprint. Critical for credential stuffing protection (login endpoint 10 req/min/IP) and scraping (search endpoint 30 req/min/IP).
• Geo-blocking — country/region restrictions (ISO 3166), ASN allow-list. Useful for non-target markets or when an attack is geographically concentrated.
• Virtual patching — blocks a known exploit pattern for a CVE before the vendor releases a patch. Cloudflare Managed Rules ship new signatures 4-24h after a CVE is published; classic example: Log4Shell (CVE-2021-44228) was blocked at the WAF layer within hours of publication, long before applications were patched.

OWASP Top 10 — what a WAF blocks (and what it does not)

A WAF is a central control for protecting against OWASP Top 10 attacks, but its coverage is not 100%. A realistic assessment for OWASP Top 10 2021/2024:

OWASP Risk	Category	WAF coverage	Comment
A01	Broken Access Control	Partial	Sees URLs/headers, does not see business logic (“can user X edit Y?”)
A02	Cryptographic Failures	None	A TLS implementation and key management problem — outside WAF scope
A03	Injection (SQLi, NoSQLi, OS, LDAP)	Full	The primary WAF domain; OWASP CRS covers all variants
A04	Insecure Design	None	Architectural — requires threat modelling, not a WAF
A05	Security Misconfiguration	Partial	Some patterns: directory listing, debug endpoints, default credentials
A06	Vulnerable Components	Partial	Virtual patching for known CVEs (Log4Shell, Spring4Shell, etc.)
A07	Authentication Failures	Partial	Brute force / credential stuffing rate limit; does not protect against weak passwords
A08	Software Integrity Failures	Partial	Detects some supply chain anomalies, but not all
A09	Logging and Monitoring Failures	None	A SIEM / SOC problem — WAF provides logs but does not analyse gaps
A10	Server-Side Request Forgery (SSRF)	Full	The WAF detects SSRF patterns in request payloads and URL parameters

In addition, a WAF blocks categories outside Top 10: bots and scrapers, L7 DDoS (HTTP flood, Slowloris), account takeover via credential stuffing, comment/form spam, vulnerability scanners (Nikto, Acunetix, Nessus probes), email harvesting, hot-linking, and content theft.

WAF operating modes — positive vs negative security

The choice of security model has fundamental operational consequences.

• Positive security (whitelist) — “default deny”: the WAF knows exactly the allowed URL paths, parameters, content types, and field lengths. Everything else is blocked. Pro: blocks zero-days without signatures (an attack on an endpoint not in the whitelist = block). Con: requires a 14-30 day learning period plus continuous updates with every new feature deployment, and tends to produce false positives. Standard in NAXSI and in ModSecurity strict mode.
• Negative security (blacklist + signatures) — “default allow”: the WAF blocks requests matching known attack patterns (OWASP CRS), letting the rest through. Pro: easier to deploy, fewer false positives, works from minute one. Con: vulnerable to bypass (encoded payloads, custom obfuscation); zero-day vulnerabilities without signatures pass through. The dominant model in Cloudflare/AWS WAF/Imperva.
• Hybrid (most modern WAFs) — a combination: signatures for known attacks + ML behavioural scoring + rate limiting + bot management + custom rules for business logic. Default in commercial cloud WAFs.
• Learning mode → Enforcement — for the first 14-30 days the WAF only observes and alerts (alert-only), gathers a traffic baseline, and calibrates rules. Then the switch is flipped to blocking. Standard deployment workflow recommended by Imperva and F5.

Top WAF vendors 2026

The WAF market in 2026 is mature — more than a dozen vendors cover everything from free tier to enterprise scrubbing capacity.

• Cloudflare — the most popular cloud WAF, free tier for basic protection, Pro ($20/mo) / Business ($200/mo) / Enterprise (custom). Magic Transit for BGP-redirected L3-4 DDoS. Gartner Magic Quadrant for Cloud WAAP 2024-2025 Leader.
• AWS WAF — native to AWS environments, integrates with CloudFront / Application Load Balancer / API Gateway / AppSync. Pay-as-you-go: $1/web ACL/month + $0.60/million requests. Often paired with AWS Shield Advanced ($3000/month) for DDoS protection.
• Akamai App & API Protector — enterprise CDN-integrated, for Fortune 500 and the financial sector. Magic Quadrant Leader, best-in-class bot mitigation.
• Imperva Cloud WAF — Magic Quadrant Leader, advanced bot management, deception technology, Reputation Intelligence Service.
• F5 Distributed Cloud WAAP (formerly Volterra + F5 Silverline) — hybrid cloud/on-prem, for organisations with legacy F5 BIG-IP ASM.
• Fastly Next-Gen WAF (acquired from Signal Sciences) — developer-friendly, API-first, CI/CD integration, Terraform provider.
• Microsoft Azure WAF — native to Azure: App Service Environment, Application Gateway, Azure Front Door, Azure CDN.
• Radware Cloud WAF + Bot Manager — strong in Europe, good for the financial sector.
• Barracuda WAF-as-a-Service — popular in SMB.
• ModSecurity + OWASP CRS — open source, self-hosted (Apache/Nginx/IIS module), $0 licensing but requires administration. ModSecurity v3 (libmodsecurity) + Connector for Nginx is the most popular combination.
• NAXSI — open source, whitelist-only WAF for Nginx, low footprint, for simple applications.
• Coraza WAF — open source, modern Go implementation, ModSecurity-compatible, deployable as an Envoy filter in a service mesh.
• HAProxy Enterprise + WAF — open source base + enterprise support.

WAF use cases by industry

The choice of configuration and vendor depends heavily on industry and traffic profile.

• E-commerce — Black Friday and Cyber Monday bot mitigation (Cloudflare Super Bot Fight Mode, Akamai Bot Manager), account takeover prevention (credential stuffing rate limit on login), scraping protection for prices and product catalogues, geo-blocking for non-EU markets where applicable.
• B2B SaaS — API rate limiting per tenant (50-1000 req/min), tenant isolation (multi-tenant WAF rules), credential stuffing block, OAuth scope enforcement, schema validation for webhooks.
• Banking / fintech — PCI DSS 4.0 Req 6.4 compliance enforcement, transaction fraud prevention, behavioural biometrics (mouse/touch patterns), device fingerprinting, geo-velocity checks (“login from Warsaw 10:00, login from Bangkok 10:05” = block).
• Healthcare — HIPAA Technical Safeguards compliance, PHI (Protected Health Information) protection, audit logging to SIEM, encryption-in-transit enforcement.
• Gaming — bot and scraper block (in-game economy abuse), L7 DDoS mitigation during peak hours, Cloudflare Spectrum for UDP-heavy game traffic.
• Media / content — scraping and hot-linking prevention, leeching protection, paywall enforcement, RSS scraper detection.
• Government / public sector — national cybersecurity framework compliance, APT-style defence, geo-blocking for hostile jurisdictions, FIPS 140-2/3 ciphers only.
• Critical infrastructure (NIS2 essential entities) — DORA + NIS2 compliance, quarterly testing documentation, incident reporting to CSIRT/CERT within 24h.

WAF and DDoS protection — sister pillars of defence

WAF and DDoS protection are often confused, but they protect different OSI layers and are complementary, not interchangeable. Deploying both together is the 2026 standard for web applications.

• DDoS scrubbing (L3-4) protects against volumetric attacks (SYN flood, UDP amplification, ICMP flood) and protocol attacks, measured in Gbps and pps. See the full guide in DDoS.
• WAF (L7) protects against application-layer attacks (HTTP flood, Slowloris, HTTP/2 Rapid Reset CVE-2023-44487, application-layer DDoS) measured in rps as well as all OWASP Top 10.
• Cloudflare as a package — Cloudflare offers WAF + DDoS protection + CDN + bot management in a single bundle (from Free to Enterprise) — the dominant model for SMB and mid-market.
• AWS as a bundle — AWS Shield Standard (free, L3-4 DDoS) + AWS WAF (L7) + AWS Shield Advanced ($3000/mo) for full enterprise protection.
• Enterprise scrubbing services (Akamai Prolexic, Imperva DDoS, NETSCOUT Arbor) typically do not include a WAF — they require a separate WAF (F5 BIG-IP ASM, Imperva WAF on-prem, or Cloudflare as a frontend).

WAF compliance and regulations 2026

A WAF is listed as a control mechanism in most security standards and industry regulations.

• PCI DSS 4.0 Requirement 6.4.1 — enforcement since March 2025; every web application handling cardholder data must have an automated technical solution that detects and prevents web-based attacks, in practice a WAF or RASP. Alternative: manual review of all application changes plus penetration testing (more expensive and slower).
• ISO/IEC 27001:2022 — A.8.23 (Web filtering) and A.8.26 (Application security requirements) — WAF mentioned in guidance as a risk-reducing control.
• NIST SP 800-53 Rev 5 — SC-7 (Boundary Protection), SI-3 (Malicious Code Protection), SI-10 (Information Input Validation) — WAF as a recommended control.
• NIS2 Directive Art. 21 (EU, transposed in Poland via the National Cybersecurity System Act) — essential and important entities deploy “appropriate and proportionate technical measures”; WAF is consistently mentioned in ENISA guidance for entities providing online services.
• DORA (Digital Operational Resilience Act) Art. 9 — financial sector since 17.01.2025; requires “tools and methods to monitor user activity and detect anomalies” in critical applications.
• HIPAA Technical Safeguards 45 CFR §164.312 — indirectly through “transmission security” and “access control”.
• GDPR Art. 32 — “appropriate technical measures” — WAF is interpreted as a baseline for web applications processing sensitive personal data.
• OWASP ASVS L1/L2/L3 (Application Security Verification Standard) — WAF as a compensating control for some verification requirements.
• CIS Controls v8 — Control 4 (Secure Configuration), Control 13 (Network Monitoring and Defense) — WAF as recommended.

WAF best practices — deployment and operations

Deploying a WAF does not end with turning it on — it requires continuous calibration, monitoring, and adaptation.

• Deploy in learning/monitor mode for the first 14-30 days — gather a traffic baseline, identify false positives, calibrate rules before switching to blocking. Jumping straight to enforcement is a classic cause of outages and business-stakeholder frustration.
• Custom rules for business-specific endpoints — the generic OWASP CRS does not know your endpoints (e.g. /api/v2/orders/{id}/refund). Add rate limits, parameter validation, and business-aware blocks (e.g. “max 5 refunds per user per day”).
• Regular tuning of false positives — target <5% false positive rate. Weekly WAF log review, whitelist legitimate edge cases (long SQL-like queries in search, JSON with embedded HTML in a CMS).
• Virtual patching for zero-days — when a critical CVE is published (Log4Shell, Spring4Shell, MOVEit), ship a WAF rule blocking the exploit pattern within hours, long before the application is patched.
• Logging to SIEM — all WAF events into Splunk / Microsoft Sentinel / Elastic Security / Chronicle. Correlation with other sources (auth logs, application logs) provides a full attack timeline.
• Rate limiting per endpoint, not just per IP — /api/login should have 10 req/min/IP, but /api/search can have 60 req/min/IP, and /static/* can be unlimited. Global limits are either too restrictive for legitimate traffic or too lax for brute force.
• Geo-blocking for non-target markets — if your application serves only PL/EU, block geo outside the list of allowed countries (watch out for VPN traffic from legitimate users!).
• Bot management as a separate layer — Cloudflare Super Bot Fight, Akamai Bot Manager, DataDome, PerimeterX — bot management is a full product, not just CAPTCHA.
• API protection separately — /api/* endpoints need different rules from HTML pages: schema validation (OpenAPI/JSON Schema), OAuth scope enforcement, BOLA/BFLA detection.
• Regular penetration testing — quarterly pentests with explicit “bypass the WAF” scope show whether the configuration is effective. Attackers always try encoded payloads, HTTP Parameter Pollution, and request smuggling.
• Hide origin IP behind WAF/CDN — the origin server must not be directly reachable. Cloudflare Authenticated Origin Pulls enforces that only Cloudflare traffic reaches the origin (mTLS); the origin firewall allow-list accepts only the WAF provider’s ASN.
• Backup origin behind WAF — the failover origin should also sit behind the WAF; do not bypass the WAF “just while there is a problem with the primary”.
• Documentation + runbooks — what to do when the WAF blocks legitimate traffic in production? Escalation, fast-track whitelist procedure, on-call rotation.

WAF trends 2026

The WAF market is evolving fast — the direction is WAAP (Web Application and API Protection) rather than pure WAF.

• AI/ML-driven WAF — Cloudflare Workers AI, Akamai Adaptive Security, AWS WAF Fraud Control. Behavioural scoring instead of (or alongside) signatures.
• API security as a separate tier — Salt Security, Noname Security, Wallarm, Traceable, Imperva API Security. Schema validation, BOLA/BFLA detection, sensitive data discovery (PII in API responses) — dedicated products rather than WAF features.
• Edge WAF (serverless) — Cloudflare Workers, Fastly Compute@Edge, AWS Lambda@Edge. Custom WAF logic in JavaScript/Rust/Wasm at the edge, millisecond latency.
• Behavioural biometrics + device fingerprinting — mouse movement patterns, typing cadence, canvas/WebGL fingerprinting; critical for account takeover prevention.
• LLM injection protection — OWASP LLM Top 10 (Prompt Injection LLM01, Insecure Output Handling LLM02, Training Data Poisoning LLM03); WAF rules for AI endpoints (Cloudflare AI Gateway, AWS Bedrock Guardrails).
• DevSecOps integration — WAF rules as code (Terraform Cloudflare provider, AWS WAF Terraform), CI/CD pipeline tests for WAF policy, shift-left application security.
• Bot management evolves into abuse prevention — not just block bots, but identify intent (fraud, scraping, account takeover, ad fraud) and respond appropriately per category.

How nFlo helps with WAF deployment and operations

Implementing and operating a WAF is a long-term process — initial configuration, learning mode, false-positive calibration, continuous rule updates for new CVEs, SIEM integration, and alert response. Outsourcing WAF management to a SOC partner avoids staffing a 24/7 in-house team and provides access to threat intelligence aggregated across many customers.

Check our services:

• SOC 24/7 — 24/7 WAF event monitoring, SIEM correlation with other sources, alert response according to playbook
• Penetration testing — WAF configuration audit and bypass attempts, verification of OWASP Top 10 blocking effectiveness
• Security audits — web application security maturity assessment, gap analysis vs PCI DSS / NIS2 / DORA, WAF deployment recommendations
• Incident Response — support during an active attack on a web application, forensic analysis of WAF logs, post-incident hardening

Related Terms

• DDoS — sister pillar; WAF protects L7 (HTTP flood), scrubbing protects L3-4
• Firewall — traditional L3-4 network firewall, complementary to WAF
• OWASP Top 10 — canonical list of the 10 most common web application risks, the main WAF target
• Cross-Site Scripting (XSS) — category of attacks blocked by WAF
• SQL Injection — category of attacks blocked by WAF (OWASP A03)
• Security Controls — broader category in which WAF is one element of the application layer
• Network Security — network context in which WAF is one of several layers