What Is a WAF? – Definition and How It Works
Learn what a web application firewall does, how rule sets and positive security models differ, where it sits, and what it cannot protect against.
A web application firewall inspects HTTP traffic and applies rules to it, blocking requests that match known attack patterns or violate a defined policy. It operates at the application layer, unlike a network firewall.
1. Where It Sits
| Position | Characteristic |
|---|---|
| Cloud or CDN edge | Filters before traffic reaches the origin; no origin capacity used |
| Reverse proxy | Self-hosted in front of the application |
| Host-based module | Inside the web server process |
| Embedded in the application | Full application context, narrowest scope |
Edge deployment is most common because it also absorbs volumetric traffic.
2. Two Security Models
Negative model — block what matches known-bad patterns. Easy to deploy, catches known attacks, and misses novel ones.
Positive model — allow only what matches a definition of legitimate requests. Much stronger, and requires an accurate model of the application's own interface, which is why it is less common.
Most deployments are negative with selective positive rules on sensitive endpoints.
3. What Rule Sets Cover
- Injection attempts — SQL, command, and template injection patterns.
- Cross-site scripting in parameters and bodies.
- Path traversal and file-inclusion patterns.
- Protocol anomalies — malformed requests and impossible header combinations.
- Known exploit signatures for common platforms.
- Custom rules written for the specific application.
4. False Positives Are the Operational Reality
Rules match patterns, and legitimate content sometimes contains those patterns. A comment quoting SQL, a technical article about injection, or a filename with unusual characters can all trigger a rule.
This is why deployments start in monitoring mode: run the rules, log what they would have blocked, and tune before enforcing. Skipping that step is the usual cause of a rollout that breaks legitimate users.
5. What a WAF Does Not Do
- It does not fix vulnerabilities. It reduces exposure while the code is fixed.
- It does not understand business logic. An authorisation flaw looks like a valid request.
- It does not stop credential stuffing on its own; that needs rate limiting and account controls.
- It does not classify bots. That is a separate product, though often bundled.
Treating a WAF as a substitute for secure code is the mistake it most often enables.
6. Relationship to Bot Management
They are complementary and frequently sold together. A WAF asks whether this request looks like an attack; bot management asks what kind of client sent it.
A well-formed request from unwanted automation passes the WAF and is caught by bot management. A malformed request from a real browser is the reverse.
7. For Legitimate Traffic
Requests carrying unusual payloads — long text, code samples, regular expressions — occasionally match attack signatures. If a specific request is consistently refused while similar ones succeed, the payload is likely the trigger, and the site operator can allow-list the endpoint or refine the rule.
8. Summary
A web application firewall inspects HTTP requests and blocks those matching attack signatures or violating a policy, usually at the edge and usually with a negative security model.
It buys time and reduces exposure; it does not remove vulnerabilities, understand business logic, or classify clients. Deploy in monitoring mode first, because false positives are the normal cost of pattern matching.