What is a web application firewall (WAF)?

WAF: definition and distinction

A web application firewall sits as a filter in front of a web application, such as an online store, a customer portal or a WordPress site. It analyzes every HTTP request and blocks those containing typical attack patterns. This primarily addresses vulnerability classes from the OWASP Top 10.

A classic network firewall decides by address and port and generally lets web traffic on port 443 pass. It cannot see whether malicious code is hidden in a form field. The WAF closes exactly this gap at the application level, so the two systems complement each other.

How a WAF works

A WAF applies rules to requests and responses. Common rule sets include the OWASP Core Rule Set, which can be used with ModSecurity, as well as vendor-specific signatures. You can also define rate limits, geoblocking, bot detection and custom rules for individual addresses, for example stricter protection for the login and the shopping cart.

A WAF is operated as a cloud service in front of the website, often together with a CDN, as a device or virtual appliance in the data center, or as a module on the web server. A phased start is common: first in monitoring mode, which only logs, then in blocking mode.

Real-world example: an online store under constant attack

A specialist tool retailer runs a Shopware store. The server logs show thousands of login attempts per hour and requests with strange strings in the search field and address. The store slows down, while scripts in the background try out stolen credentials and known vulnerabilities.

An upstream cloud WAF filters this traffic before it reaches the server: bots are throttled, injection patterns are blocked, and the admin area is only reachable from certain networks. The retailer reviews the logs regularly and adjusts exceptions so that genuine customers are not locked out.

Benefits, limits and common mistakes

A WAF buys time: it can shield known vulnerabilities with a “virtual patch” until the update is installed, and it throttles automated attacks that would otherwise burden server and budget. It does not replace secure code, though. Misconfigured, it blocks legitimate requests (false positives) or lets attacks through; a WAF that is installed once and never maintained hardly protects in the long run.

Nano Concepts sets up WAF protection for websites and web applications, tests the rules with realistic requests and combines it with updates, hardening and monitoring. The result is protection that shields your shop and portal from attacks without getting in the way of genuine customers’ purchases.

• Installed, but left permanently in monitoring-only mode
• Origin server remains directly reachable by IP address and bypasses the WAF
• No exceptions for payment or API interfaces, so customers get locked out
• Rules and logs are not maintained or reviewed
• WAF used as an excuse to postpone updates and code reviews