What Web application firewall (WAF) means
A WAF catches many common attacks before they reach your site, including attempts to exploit known plugin flaws. Many CDNs and managed hosts include one. It reduces risk but does not replace updates and secure code.
Why it matters for your website
A WAF blocks many automated attacks before they reach your site, which reduces the risk of hacks, spam and downtime. It is an extra shield that buys you time when a new flaw is found and a fix is not yet installed.
Example
A hypothetical online store turns on a WAF that blocks thousands of bot login attempts against its admin page each week.
Tips
- Turn on a WAF through your host, CDN or security plugin.
- Review blocked requests now and then to catch false positives.
- Keep software updated anyway, since a WAF is not a replacement for patching.
Common mistakes
- Setting rules so strict that real customers and payment tools get blocked.
- Thinking a WAF makes updates and backups unnecessary.
Questions about Web application firewall (WAF)
What is Web application firewall (WAF)?
A filter that sits in front of a website and blocks malicious requests such as SQL injection and bot attacks.
Do small business websites need a WAF?
Many benefit from one, since automated attacks target sites of every size. Some hosts and CDNs include a basic WAF in their plans.
What is the difference between a WAF and a regular firewall?
A network firewall controls traffic by ports and addresses. A WAF inspects web requests themselves to spot attacks like SQL injection and cross-site scripting.
