Web application firewall
WAF / website firewall / cloud WAF
A web application firewall (WAF) is a filter that sits in front of or inside a website's server and applies rules to incoming HTTP requests, blocking those matching common attacks such as SQL injection. It can shield a known flaw quickly while a fix is written, but OWASP notes that the source code is left unchanged.
Cloudflare, which sells a cloud WAF, calls a WAF a type of reverse proxy that protects the server by having clients pass through it first. It follows that requests sent straight to the origin server, the machine that hosts the site, never pass through the WAF.
Cloudflare's guidance for origin servers gives its own reason to keep them hidden. It says securing origin connections prevents attackers from discovering and overloading the server with requests. Its list starts with proxied DNS records, used when possible, which hide the origin IP address. Cloudflare also advises auditing DNS-only records such as SPF and TXT for that address, and rotating origin IPs after onboarding, because historical DNS records are kept.
For its own service, Cloudflare rates blocking all traffic that does not come from Cloudflare IP addresses as moderately secure and vulnerable to IP spoofing. It rates Cloudflare Tunnel and Authenticated Origin Pulls as very secure, and lists both for all customers.
Using a WAF rule to stop attacks on a known flaw is what OWASP calls a virtual patch. The attack fails while the application's source code stays unmodified. OWASP says virtual patching is ideally suited for injection-type flaws but may not give adequate protection against other attack types, and that it may not be a complete fix.
OWASP's community page defines a WAF as an application firewall for HTTP applications, and says it can be considered a reverse proxy. Its rules generally cover attacks such as cross-site scripting and SQL injection. OWASP's Virtual Patching Cheat Sheet lists WAF appliances, web server plugins such as ModSecurity, and application layer filters as tools. Cloudflare adds cloud WAFs, which it says can usually be switched on with a DNS change.
A blocklist denies traffic based on known attack patterns, and an allowlist admits only traffic that has been pre-approved. Many WAFs combine both. OWASP warns that tailoring a WAF to one application can take significant effort that has to be maintained as the application changes.
On Cloudflare's Free plan the managed rules are limited to its Free Managed Ruleset, which covers high-impact and widely exploited vulnerabilities. Its broader Managed Ruleset and its version of the OWASP Core Rule Set start on paid plans.
In practice
A landscaping company's WordPress site uses a booking plugin, and a SQL injection flaw in that plugin is published before an update exists. The web developer adds a WAF rule for the plugin's vulnerable page that accepts only the input the page expects. OWASP recommends this allowlist approach and warns against a rule that blocks only the exact published exploit. The rule runs in log-only mode first to confirm real bookings still go through. Once the plugin update is installed and tested, the developer reviews whether the rule is still needed.
Not the same as
- Network layer firewall
- Cloudflare calls a WAF a protocol layer 7 defense that filters HTTP traffic, and says it is not designed to defend against all types of attacks. Its origin guidance files rules based on IP addresses, such as blocking all traffic that does not come from Cloudflare, under the network layer.
- Fixing the code
- OWASP says that from a purely technical perspective, correcting the flaw in the source code is the number one remediation strategy. It adds that real business situations, such as third-party software, can make updating the code hard. A virtual patch stops the attack while the code stays unmodified, and OWASP says code fixes and virtual patching are not mutually exclusive.
Why it matters to you
A WAF is a fast way to shield a website from common attacks while slower fixes happen. It covers the flaws its rules recognize, and only for traffic that passes through it. The plugins, settings and code still need an owner. A rule nobody reviews can also block real customers.
What to ask or check
- 01Does your site sit behind a WAF, and which rulesets are switched on for your plan?
- 02Can anyone reach your server directly without passing through the WAF, and how is the origin locked down?
- 03When a WAF rule blocks a known flaw, when will the underlying code or plugin be fixed?
- 04Who reviews blocked requests to make sure real customers are not being turned away?
What people get wrong
That a WAF fixes the flaws it blocks. OWASP describes a WAF rule against a known flaw as a virtual patch: the attack fails, the source code stays unmodified, and the rule may not be a complete fix.
Red flags
- A WAF rule offered as the fix for a known flaw, with no date for patching the code or plugin.
- A site behind a cloud WAF whose origin IP address still appears in DNS-only records such as SPF or TXT, which Cloudflare advises auditing.