What is a WAF (Web Application Firewall)?

A network firewall decides which connections reach your server. But what about a request that's perfectly allowed — on port 443, well-formed HTTPS — yet carries an attack inside it, like an attempt to inject SQL? That's where a WAF comes in: a firewall that understands the web.

What a WAF is

A WAF (Web Application Firewall) inspects HTTP requests and blocks ones that look malicious, based on rules and patterns. Where a network firewall works at the connection level (IP/port), a WAF works at the application layer — looking inside the request at the URL, headers, and body.

Request ──► [ WAF: looks malicious? ] ──► your app
                       └─ block (403) if it matches an attack pattern

It sits in front of your app (often at your CDN or reverse proxy) and filters the traffic before it ever reaches your code.

What it protects against

A WAF targets the common web attacks — many from the famous OWASP Top 10:

Attack	What it tries to do
SQL injection	Sneak database commands into inputs
Cross-site scripting (XSS)	Inject malicious scripts into pages
Path traversal	Reach files outside the web root
Bad bots / scrapers	Abuse, scrape, or brute-force
Known exploits	Probe for unpatched vulnerabilities

When a request matches an attack signature, the WAF blocks it (typically with a 403) before your application ever sees it.

Network firewall vs WAF

They're complementary, not interchangeable:

	Network firewall	WAF
Works at	Connection level (IP/port)	Application level (HTTP)
Blocks	Unwanted connections	Malicious requests
Sees	Where traffic comes from	What the request actually contains

You want both: the network firewall controls who connects, the WAF inspects what they send.

What a WAF doesn't do

A WAF is a strong layer, not a silver bullet:

It doesn't replace secure code. It's defence-in-depth, catching common patterns — but you still need to validate inputs and fix vulnerabilities (CVEs).
It can have false positives — over-aggressive rules occasionally block legitimate traffic (sometimes including your own monitoring or API clients), so it needs tuning.
It's one layer in a stack that also includes rate limiting, DDoS protection, and good app security.

Think of a WAF as a smart bouncer reading what's in people's bags, not just checking IDs. It catches the obvious attacks at the door — but you still lock your valuables (write secure code) inside.

A monitoring note

WAFs can both cause and hide issues. An over-tuned rule might block legitimate users (watch for unexpected 403s); and if your checks come from external probe IPs, make sure the WAF allowlists them so it doesn't flag your own monitoring as an attack.

The bottom line

	In one line
What	A firewall that inspects HTTP requests for attacks.
Blocks	Injection, XSS, path traversal, bad bots, known exploits.
vs network firewall	App-layer (what's inside) vs connection-layer (who connects).
Not	A replacement for secure code — it's one layer.

A WAF is the bouncer that actually reads what people are carrying — blocking the common web attacks before they reach your app. Pair it with a network firewall, rate limiting, and secure code, and you've got real defence in depth.