WAF
WAF (Web Application Firewall) is a firewall that filters, monitors, and blocks HTTP/HTTPS traffic to web applications. It sits between users and the web server, analyzing each request against defined rules.
Term
description · examples · notesWAF (Web Application Firewall) is a firewall that filters, monitors, and blocks HTTP/HTTPS traffic to web applications. It sits between users and the web server, analyzing each request against defined rules.
Description
WAF protects against common web application attacks such as SQL injection, cross-site scripting, request forgery, and other application-layer attacks. It can operate in blocking or monitoring mode.
This technology is an important protection layer for public-facing web applications but does not replace secure software development and regular application testing.
What people often say
- WAF eliminates the need for secure application development.
- WAF in default configuration provides complete protection.
Covers / does not cover
Covers
- Protection against common web application attacks
- Filtering malicious requests before they reach the application
- Virtual patching of known vulnerabilities until a real patch is applied
- Protection against automated attacks and bots
Does not cover
- Attacks not passing through HTTP/HTTPS (e.g., network-layer attacks)
- Application logic flaws that do not generate recognizable patterns
- Internal attacks that do not pass through the WAF
Mentioned in the news
Threats
reduces 12Techniques
neutralizes 3Techniques it neutralizes. Select one to open its page.