Digital Lexicon Hub

A security control that inspects HTTP traffic to a web application and blocks requests matching attacks such as SQL injection or cross-site scripting.

A WAF gives fast protection for websites and APIs while code fixes are scheduled, reducing the chance that a known plugin or framework vulnerability leads to downtime, defacement or data loss.

A WordPress site behind a cloud WAF runs the OWASP Core Rule Set in detection mode for two weeks, tunes 12 false positives on form submissions, then switches to blocking and limits login attempts to 20 per minute per IP.

A WAF does not fix vulnerable code and can be bypassed by encoding tricks or business logic attacks. Poorly tuned rules block legitimate users, and an origin server reachable directly by IP address lets attackers skip the WAF entirely.

A WAF works at the application layer, usually as a reverse proxy in front of the origin, and evaluates each request against policies. Negative models block known attack signatures, positive models allow only expected traffic, and many products combine both with rate limiting. Deployment can be network-based, host-based or cloud-based, often through a DNS change. The OWASP ModSecurity Core Rule Set is a common baseline, and a WAF often works alongside Bot Protection and Distributed Denial of Service (DDoS) mitigation.