Web Application Firewall
Definition
A web application firewall, usually shortened to WAF, sits between the visitor and the site and inspects the whole request: method, path, query string, headers and body. Rules describe things a legitimate request would never contain — a SQL fragment in a search parameter, a script tag in a form field, a sequence of dot-dot-slash steps trying to climb out of a directory. Most deployments start from a shared ruleset such as the OWASP Core Rule Set, then add or mute individual rules. Each matching rule normally contributes to an anomaly score, and the request is blocked once that score crosses a threshold, which makes the system less brittle than a single rule firing alone. A WAF protects an application; for purely static content there is no database to inject into and no server code to trick, so its useful work narrows to turning away scanners, blocking cross-site scripting attempts in anything interactive, and shielding forms.
Why It Matters
Any public address attracts probes within hours of being indexed — requests for administrator pages, configuration files and backup archives that were never there. On a static host those return 404 and do no harm, but they bury the real numbers in noise and occasionally find something genuinely left behind, such as an environment file uploaded with a folder by accident. Where a WAF earns its place is the interactive edge of a site: a form, an API endpoint, an upload path. A rule that rejects submissions with bodies over a sensible size, or from clients that never load the page first, removes most automated junk before a human reads any of it. The cost is false positives, which is why every sensible rollout runs in logging mode first and only then starts blocking.
How It Works
The request reaches the edge and is evaluated against the ruleset before anything is fetched from storage. Rules are ordinary pattern matches against named parts of the request — Content-Type, User-Agent, Referer, the decoded query string, the raw body — and each carries an action: allow, log, challenge or block. A blocked request ends with HTTP 403 Forbidden and a reference identifier, so a wrongly blocked visitor has something to quote in a support message. Rate rules sit alongside the pattern rules and count requests per IP address or per path, which is where a WAF overlaps with DDoS protection. Because everything happens before the origin is touched, a blocked request costs no bandwidth and no storage read.
Real-World Example
A consultancy puts a whitepaper behind a lead capture form at fintech-guide.99helpers.site and starts getting forty submissions a night, all with a first name of test and a throwaway address. The pattern is easy to describe: no referrer, the same handful of networks, a submission under two seconds after the page loaded. A rule that challenges those requests takes the list back to six real people a week. On 99helpers the form itself stays exactly as it was — the change is in what reaches it.
Common Mistakes
- ✕Switching every rule to block on day one — the first casualty is usually a real visitor with an unusual browser or an aggressive corporate proxy
- ✕Expecting a WAF to fix a genuinely insecure page — it is a filter in front of the problem, not a repair to it
- ✕Forgetting that a WAF sees only what passes through it — a file reachable by a second address, bypassing the edge, is not covered
Related Terms
DDoS Protection
The defences that keep a site reachable while someone floods it with traffic from many machines at once. A distributed denial-of-service attack is not a break-in — it is an attempt to exhaust bandwidth, connections or compute until real visitors get nothing.
Cross-Site Scripting
A flaw in which text supplied by a visitor ends up being executed as JavaScript on your page. Because the script runs on your origin, it inherits everything your page can see.
Bot Traffic
Requests made by software rather than a person — search crawlers, link previewers, monitors, scrapers and scanners. On a typical public address a large share of raw hits are never human.
Security Header
An HTTP response header that instructs the browser to enforce a restriction on a page — what it may load, who may frame it, how much of its URL leaks. The server states the rule; the browser applies it.
Lead Capture Form
A short form shown in front of a hosted file or site: the visitor gives a name and an email, the content opens, and the answer lands in the owner's dashboard.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →