Back to Glossary
Defense

WAF (Web Application Firewall)

Firewall for protecting web applications from attacks

WAF (Web Application Firewall) is a protective shield that filters and monitors HTTP traffic between a web application and the internet. WAF protects against SQL injections, XSS, CSRF, and other web application attacks.

Deployment Models

  • Cloud WAF — cloud-based (Cloudflare, AWS WAF)
  • Appliance WAF — hardware-based (F5, Fortinet)
  • Software WAF — software-based (ModSecurity)

Protection Methods

  • Signature-based — based on known attack signatures
  • Behavior-based — based on behavioral anomalies
  • Reputation-based — based on IP reputation

What It Protects Against

  • SQL Injection
  • Cross-Site Scripting (XSS)
  • DDoS attacks (Layer 7)
  • Bots and scanners
  • OWASP Top 10

Popular Solutions

  • Cloudflare WAF
  • AWS WAF
  • ModSecurity
  • Imperva WAF

Related Terms

Category

WAF, SIEM, SOC, EDR, protection and monitoring tools