---
title: What is a WAF (Web Application Firewall)?
description: A regular firewall guards the network; a WAF guards your application — inspecting web requests and blocking attacks like injection and bots. Here's how it works and what it does (and doesn't) cover.
canonical: https://watchfor.io/blog/waf-explained
---

# What is a WAF (Web Application Firewall)?

2025-12-16 · WatchFor Team · Security · security, web

A regular firewall guards the network; a WAF guards your application — inspecting web requests and blocking attacks like injection and bots. Here's how it works and what it does (and doesn't) cover.

A network [firewall](/blog/what-is-a-firewall) decides which connections reach your server. But what about a request that's perfectly *allowed* — on port 443, well-formed HTTPS — yet carries an attack inside it, like an attempt to inject SQL? That's where a **WAF** comes in: a firewall that understands the *web*.

## What a WAF is

A **WAF (Web Application Firewall)** inspects **HTTP requests** and blocks ones that look malicious, based on rules and patterns. Where a network firewall works at the connection level (IP/port), a WAF works at the **application layer** — looking *inside* the request at the URL, headers, and body.

```
Request ──► [ WAF: looks malicious? ] ──► your app
                       └─ block (403) if it matches an attack pattern
```

It sits in front of your app (often at your [CDN](/blog/what-is-a-cdn) or [reverse proxy](/blog/reverse-proxy-explained)) and filters the traffic before it ever reaches your code.

## What it protects against

A WAF targets the common web attacks — many from the famous OWASP Top 10:

| Attack | What it tries to do |
| --- | --- |
| **SQL injection** | Sneak database commands into inputs |
| **Cross-site scripting (XSS)** | Inject malicious scripts into pages |
| **Path traversal** | Reach files outside the web root |
| **Bad bots / scrapers** | Abuse, scrape, or brute-force |
| **Known exploits** | Probe for unpatched vulnerabilities |

When a request matches an attack signature, the WAF blocks it (typically with a [403](/blog/403-forbidden)) before your application ever sees it.

## Network firewall vs WAF

They're complementary, not interchangeable:

| | Network firewall | WAF |
| --- | --- | --- |
| **Works at** | Connection level (IP/port) | Application level (HTTP) |
| **Blocks** | Unwanted connections | Malicious *requests* |
| **Sees** | Where traffic comes from | What the request actually contains |

You want both: the network firewall controls *who connects*, the WAF inspects *what they send*.

## What a WAF doesn't do

A WAF is a strong layer, not a silver bullet:

- It **doesn't replace secure code.** It's defence-in-depth, catching common patterns — but you still need to validate inputs and fix vulnerabilities ([CVEs](/blog/what-is-a-cve)).
- It can have **false positives** — over-aggressive rules occasionally block legitimate traffic (sometimes including your own [monitoring](/blog/what-is-a-firewall) or API clients), so it needs tuning.
- It's **one layer** in a stack that also includes [rate limiting](/blog/rate-limiting-explained), [DDoS protection](/blog/what-is-a-ddos-attack), and good app security.

> **Think of a WAF as a smart bouncer reading what's in people's bags, not just checking IDs.** It catches the obvious attacks at the door — but you still lock your valuables (write secure code) inside.

## A monitoring note

WAFs can both *cause* and *hide* issues. An over-tuned rule might block legitimate users (watch for unexpected [403s](/blog/403-forbidden)); and if your checks come from external [probe IPs](/docs/reference/probe-locations), make sure the WAF allowlists them so it doesn't flag your own monitoring as an attack.

## The bottom line

| | In one line |
| --- | --- |
| **What** | A firewall that inspects HTTP requests for attacks. |
| **Blocks** | Injection, XSS, path traversal, bad bots, known exploits. |
| **vs network firewall** | App-layer (what's inside) vs connection-layer (who connects). |
| **Not** | A replacement for secure code — it's one layer. |

A WAF is the bouncer that actually reads what people are carrying — blocking the common web attacks before they reach your app. Pair it with a network firewall, rate limiting, and secure code, and you've got real defence in depth.

Related: [What is a firewall?](/blog/what-is-a-firewall), [rate limiting](/blog/rate-limiting-explained), [what is a DDoS attack?](/blog/what-is-a-ddos-attack).

---

Canonical page: https://watchfor.io/blog/waf-explained · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt