🎁 New User? Get 20% off your first purchase with code NEWUSER20 · ⚡ Instant download · 🔒 Secure checkout Register Now →
Menu

Categories

Security Intermediate

What is WAF (Web Application Firewall)?

A security solution that filters and monitors HTTP traffic between a web application and the internet, blocking common attacks.

WAFs protect against OWASP Top 10 attacks: SQL injection, XSS, CSRF, and more. They inspect HTTP requests and responses, applying rules to detect and block malicious patterns. WAFs can be network-based, host-based, or cloud-based.

Popular WAFs include Cloudflare WAF, AWS WAF, ModSecurity (open-source), and Imperva. WAF rules include signature-based detection (known attack patterns), rate limiting, IP reputation, and bot detection. WAFs complement but do not replace secure coding practices.

Related Terms

OWASP Top 10
A regularly updated list of the ten most critical web application security risks, published by the Open Web Application Security Project.
Security Audit
A systematic examination of an information system to assess compliance with security policies, identify vulnerabilities, and verify controls.
Content Security Policy (CSP)
An HTTP security header that controls which resources a browser is allowed to load for a web page, preventing XSS and data injection.
Principle of Least Privilege
A security principle where users and programs receive only the minimum access rights needed to perform their specific tasks.
DDoS (Distributed Denial of Service)
An attack that floods a target server or network with traffic from multiple sources to overwhelm it and deny service to legitimate users.
Vulnerability Scanning
Automated testing that identifies known security weaknesses in systems, applications, and network infrastructure.
 View All Security Terms →