A web application firewall (WAF) sits in front of your website and inspects every incoming request before it reaches your server. If a request looks like an attack — SQL injection, cross-site scripting, a bot scanning for vulnerabilities — the WAF blocks it.
What a WAF protects against
- SQL injection — attempts to manipulate your database through form inputs or URLs
- Cross-site scripting (XSS) — injecting malicious scripts into your pages
- Remote file inclusion — tricking your server into loading external malicious code
- Path traversal — requesting files outside the web root
- Bad bots — scrapers, vulnerability scanners, credential stuffers
Most WAFs also include rate limiting, helping defend against brute-force attacks and some DDoS.
WAF vs. a network firewall
A traditional firewall controls which ports and IP addresses can connect to your server. A WAF operates at the application level — it understands HTTP requests and can inspect the content of what's being sent, not just where it's coming from. You can have both. They protect different things.
Do you need one?
If your site accepts user input, runs e-commerce, uses WordPress, or has experienced bot traffic — yes, a WAF is worth having. For most sites, a cloud-based WAF (Cloudflare, Sucuri, AWS WAF) is the easiest path. Point your domain at it, and it proxies traffic to your server. No software to install.
threatprobe.app's free scan detects whether a WAF is protecting your site.