WAF - Web Application Firewall Protection

About 2 min read

A WAF (Web Application Firewall) is a dedicated firewall that inspects HTTP/HTTPS traffic to a web application and detects and blocks attacks such as SQL injection and XSS. Whereas a conventional firewall controls communication at the network layer (IP addresses, port numbers), a WAF analyzes the application layer (the contents of HTTP requests). As of 2025, enhancements to WAF features specialized for API security are advancing.

Real-World Use Cases

"We detected a credential stuffing attack against the login page of an e-commerce site using the WAF. There were more than 200 login attempts from the same IP within one minute, and the WAF's rate-based rules automatically blocked it. We were able to block the attack with no impact on legitimate users."

WAF Detection Methods

The signature-based method detects attacks by defining known attack patterns (for example, request parameters containing SQL statements) as rules. The scoring method assigns scores to multiple suspicious characteristics and blocks requests that exceed a threshold. The machine-learning-based method learns normal traffic and automatically detects anomalous requests. Cloud WAFs such as AWS WAF, Cloudflare WAF, and Akamai have the strength of being able to reflect global threat intelligence into their rules in real time.

How Far Into the Same Request Each Layer Looks

Network layer - the range a conventional firewall can use to decide

Source IP addressDestination port number

With only this range, you cannot tell whether a submission that reached the login page is legitimate input or an attack.

A WAF analyzes the contents of that same request

Application layer - the range a WAF analyzes (the contents of the HTTP request)

URL path and method

A submission to the login page of an e-commerce site

If there are more than 200 login attempts from the same IP within one minute, rate-based rules block it automatically (credential stuffing).

Query parameters

The string entered in the search form

If the request parameters contain SQL statements, the signature-based method detects them as a known attack pattern (SQL injection).

Request body

The content sent as a review submission

It detects and blocks a script planted in the submitted text (XSS).

If it is not judged to be an attack, the request is forwarded to the web server.

If it is judged to be an attack, the request is blocked here and never reaches the web server.

Even if a request matches no single pattern, the scoring method blocks it once the combined score of its suspicious characteristics exceeds the threshold. With the machine-learning-based method, deviation from the normal traffic it has learned is itself the basis for judgment. Note that in the monitoring mode used right after deployment, a request judged to be an attack is still forwarded to the web server instead of being blocked.

Deployment Scenarios and Operation

On an e-commerce site, the WAF defends against credential stuffing attacks on the login page, SQL injection on the search form, and XSS on review submissions. Right after deployment, it is safer to operate in monitoring mode (detection only, no blocking), grasp the patterns of false detections, and then switch to blocking mode. Handling false positives, in which legitimate requests are mistakenly blocked, is the greatest challenge of WAF operation. By combining DNS security with a WAF, you can achieve multi-layered web defense.

Limitations of a WAF

A WAF is merely one layer of defense and is no substitute for fixing the vulnerabilities of the application itself. Since there are also advanced attack techniques that bypass WAFs, both secure coding and a WAF are necessary. Protect the WAF management console with a strong random password and record the change history of rules in an audit log.

Related Terms

Was this article helpful?

← Back to Glossary