What is a Web Application Firewall?

A web application firewall (WAF) controls HTTP and HTTPS traffic in front of a website or API. It analyzes requests and sometimes responses, and can allow, log, alter, delay or block them. Unlike a traditional network firewall, it understands application features such as URLs, methods, headers, cookies and request bodies.

How does a WAF work?

Rule-based WAFs search for known attack patterns, unusual strings or deviations from an expected request. Positive security models allow only defined methods, parameters, data types and sizes; negative models block known malicious patterns. Many products combine both with reputation data, bot detection, rate limiting and statistical methods. No detection is perfect: application context and normal traffic remain important.

Which deployment models exist?

The WAF must be on the only reachable path. If the origin remains directly accessible through its IP, an old hostname or a second load balancer, attackers can bypass the control.

What can a WAF help against?

• Recognizable patterns of SQL injection, XSS, path traversal and other HTTP-based input attacks.
• Disallowed methods, oversized bodies, malformed protocol features and known scanners.
• Automated login guessing, scraping and certain bots through limits and challenges.
• Rapid temporary restriction of a particular vulnerable path.
• Central telemetry for blocked and suspicious web requests.

Effectiveness depends on parsing. Double encoding, different content types, GraphQL, WebSockets, file uploads and inconsistent interpretation between WAF and backend can complicate controls or enable bypass.

What can a WAF not detect reliably?

A WAF normally does not know business authorization. When a signed-in customer submits a valid-looking request for another customer's document, only the application can reliably judge the missing object permission. The same applies to business logic, unsafe workflows, configuration behind the WAF, compromised credentials and vulnerabilities in uncovered traffic. TLS termination alone does not make an application secure either.

What is a virtual patch?

A virtual patch is a focused WAF rule intended to block a known attack against an uncorrected vulnerability. It can reduce exposure temporarily when a regular update takes time. It fixes neither the code defect nor alternative paths and may be bypassed by new variants. It therefore needs an owner, monitoring, an expiry date and a planned application fix.

How is a WAF operated securely?

1. Start in monitoring mode to understand normal traffic and false positives.
2. Version rule sets, test changes and move into blocking gradually.
3. Restrict origin access to the WAF and handle trusted proxy headers explicitly.
4. Secure TLS, certificates, keys, administrative access and high availability of the WAF itself.
5. Correlate events with request IDs and application telemetry while minimizing sensitive log content.
6. Keep exceptions narrow, justified, temporary and subject to retesting.

How is its effectiveness tested?

Testing needs known attacks, legitimate edge cases, encoding variants and application-specific requests. It checks not only whether a rule blocks but whether the origin is still directly reachable, logs support investigation and legitimate users are affected. A penetration test should account for the WAF as an existing layer while still assessing application security itself. “WAF detected” proves neither a secure nor an insecure application.