A WAF (web application firewall) filters and blocks malicious HTTP requests before they reach your website.
A WAF, or web application firewall, inspects every HTTP request sent to your website and blocks the ones that look like attacks. It sits in front of your site's code, so harmful requests are stopped before WordPress, your shop software or your custom application ever sees them.
A normal network firewall decides which connections are allowed, based on things like IP address and port. A WAF goes further and reads the content of web requests: the URL, form fields, cookies and headers. That lets it spot attacks that look like ordinary web traffic, such as a login form stuffed with database commands.
What a WAF protects against
- SQL injection: sneaking database commands into forms or URLs
- Cross-site scripting (XSS): injecting scripts that run in other visitors' browsers
- File inclusion and path traversal: tricking the server into running or revealing files
- Brute-force logins: thousands of password guesses against a login page
- Known plugin and theme exploits: attacks on published vulnerabilities, often blocked before you've had a chance to update
- Bad bots: scrapers and scanners probing for weaknesses
How a WAF works
A WAF compares each request with a set of rules. Some rules match known attack patterns, some look for unusual behaviour, and some use reputation lists of IP addresses known to be malicious. Matching requests are blocked, challenged or logged. The rules are updated regularly as new vulnerabilities appear, which is a big part of a WAF's value.
Types of WAF
- Server-based: runs on the web server itself, often as part of a security suite like Imunify360 or a web server module.
- Cloud-based: runs at a proxy or CDN in front of your site, filtering traffic before it reaches your server.
- Application plugins: run inside your app, such as a WordPress security plugin. Easy to set up, but the request has already reached your site.
You can combine them, for example a cloud WAF from your CDN plus the server-level WAF from your host.
Why a WAF matters for your website
Most website attacks are automated. Bots scan the web around the clock for sites running a vulnerable plugin version, and a newly published flaw can be exploited within hours. A WAF buys you time to update and blocks a large share of this background noise. It doesn't replace keeping software updated, using strong passwords with two-factor authentication, and having backups.
Common WAF problems
The main one is false positives, where a legitimate request is blocked, for example when you save a page that contains code snippets. If a normal action suddenly fails with a 403 error, check whether the WAF blocked it. Your host can usually allowlist the specific rule for your site rather than turning protection off.