Definition
A WAF (Web Application Firewall) is a security layer that inspects every HTTP request to a website and filters or blocks malicious patterns before they reach the application. It sits in front of the app, as a reverse proxy or CDN edge node, and checks each request's headers, URL parameters and body against rule sets, typically catching the OWASP Top 10 classes: SQL injection, cross-site scripting, file inclusion, and broken authentication abuse, plus credential-stuffing bots, scrapers and known exploit signatures. Most WAFs today are delivered as a managed cloud service (Cloudflare, AWS WAF, Imperva, Sucuri) rather than installed on the server, so rule updates roll out within hours of a new vulnerability being disclosed, without any change to the app itself. Many CDNs bundle a WAF into their security tier. The tradeoff: rules can misfire on legitimate traffic (false positives), and a WAF cannot fix an insecure application, it only reduces the attack surface reaching it.
How it works
A WAF applies a set of rules (vendor-managed plus custom) to every request: block known bad payloads, rate-limit suspect IPs, challenge browsers that look automated, and log everything for inspection. The strongest WAFs combine rule sets with machine-learning models trained on attack traffic.
Why it matters
A WAF is the cheapest serious upgrade to a site's security posture, defending against attacks that a fresh-installed WordPress or unpatched library is vulnerable to. It does not replace good code, but it buys time when a vulnerability is discovered and absorbs the constant background noise of internet-wide attack traffic.