WAF — Explained with Examples

A WAF (Web Application Firewall) filters, monitors, and blocks HTTP traffic to and from web applications, protecting against common web exploits.

WAF stands for Web Application Firewall. Unlike a traditional firewall that blocks ports, a WAF inspects HTTP traffic at the application layer and understands web-specific threats like SQL injection, XSS, and CSRF.

How a WAF Works

A WAF sits between users and your web application, analyzing every request and blocking malicious ones based on rule sets.

User → Internet → WAF → Web Server → Database
           ↑                       
      Malicious request blocked here

Common WAF Rule Categories

• SQL Injection — blocks requests containing SQL keywords in unexpected places
• XSS (Cross-Site Scripting) — blocks script tags and event handlers
• CSRF (Cross-Site Request Forgery) — validates anti-CSRF tokens
• Path Traversal — blocks ../ patterns
• Rate Limiting — throttles excessive requests
• OWASP Top 10 — comprehensive protection against the most critical risks

Real-World Analogy

A WAF is like a bouncer at an exclusive club who knows all the tricks. Regular security checks IDs (firewall). This bouncer looks deeper — checking for fake IDs, scanning for weapons, recognizing known troublemakers, and watching for people trying to sneak in through side doors. He doesn’t just check “are you on the list?” — he asks “are you trying to cause trouble?”

Example: ModSecurity (Open-Source WAF)

# ModSecurity rule: Block SQL Injection attempts
SecRule ARGS "@contains SELECT.*FROM" \
  "id:100001, \
   phase:2, \
   deny, \
   status:403, \
   msg:'SQL Injection detected'"

# Block requests with script tags (XSS)
SecRule ARGS "@contains <script" \
  "id:100002, \
   phase:2, \
   deny, \
   status:403, \
   msg:'XSS attempt blocked'"

# WAF in action (NGINX + ModSecurity logs)
2026/06/19 10:00:00 [warn] ModSecurity: Access denied with code 403...
  [msg "SQL Injection detected"]
  [uri "/api/users?id=1 UNION SELECT * FROM passwords"]
  [client 203.0.113.42]

Deploying a WAF

Related Terms

IDS/IPS, XSS, SQL Injection, OWASP, API Gateway