WAF (Web Application Firewall): What It Is & Do You Need It?

What is a WAF?

A WAF (Web Application Firewall) is software that filters HTTP traffic before it reaches your server. It blocks: - SQL injection attempts - Cross-site scripting (XSS) - Brute force logins - DDoS attacks - Malicious bots - Geo-blocking (if needed) - Known attacker IPs

A WAF protects against 90%+ of the attacks listed in the OWASP Top 10.

How does a WAF work?

User → WAF (Filters) → Your Server
            ↓
        Malicious → BLOCK

A WAF uses specific rules: - Known attack patterns (signature-based) - Anomalies (behavioural models) - ML models (modern WAFs)

Types

1. Cloud WAF (Recommended for 2026) - Cloudflare, Sucuri, AWS WAF - Easy to install (DNS change) - Maintained by the provider - DDoS protection included - Price: £0 – tens of pounds/month

2. Plugin WAF - Wordfence, Sucuri plugin - Runs inside WordPress - Limited (traffic has already reached the server) - Free versions are decent

3. Server WAF (ModSecurity) - At the Apache/Nginx level - Open source - Requires configuration - Good for experienced admins

4. Hardware WAF - For large enterprises - F5, Imperva, Fortinet - Expensive (£10,000+)

Free vs Paid

Free options - **Cloudflare Free** – basics (rate limits, country blocking, basic rules) - **Wordfence Free** – reliable plugin - **ModSecurity + OWASP CRS** – self-hosted

Paid options - **Cloudflare Pro** ($20/month) – full rule set, image optimisation - **Sucuri Firewall** ($200/year) – professional grade - **Wordfence Premium** ($119/year) – real-time threat feed

Cloudflare WAF Setup

1. Point DNS to Cloudflare (see [CDN Comparison](/blogi/cdn-cloudflare-vs-bunny)) ### 2. SSL → Full (Strict) ### 3. Security → WAF - Managed Rules: ON - OWASP Core Rule Set: ON - Sensitivity: Medium (to start with)

4. Rate Limiting (Pro) - /wp-login.php: max 5 req/min - /xmlrpc.php: max 1 req/min

5. Bot Fight Mode: ON - Blocks known malicious bots - Bypass: Allows useful bots (Googlebot, Bingbot)

6. Geo-blocking (if needed) - Typical local business: not required - Against spam: block countries where you have no customers

Typical WAF Rules

SQL Injection ```text Block: union select, ' OR 1=1, /**/, sleep( ```

XSS ```text Block: <script>, javascript:, onerror= ```

Path traversal ```text Block: ../, ../../etc/passwd ```

File upload ```text Block: .php upload via form ```

False Positives

A WAF can occasionally block legitimate requests: - Contact forms with long messages - Admins editing SQL code - API calls

Solution: Whitelist legitimate IPs / URLs.

Monitoring WAF Logs

Cloudflare → Analytics → Security: - Blocked requests - Attack types - Geo-distribution - Top targets

Set up email alerts for high activity spikes.

DDoS Protection

A WAF usually includes DDoS protection: - L3/L4 (packet level) - L7 (application level, the most difficult to stop)

Cloudflare blocks over 100 billion attacks every second.

Do You Need a WAF?

Limitations

A WAF does NOT protect against: - Weak passwords (use 2FA) - Plugin vulnerabilities (keep them updated!) - Social engineering (see phishing) - Insider threats - Physical attacks

Real-World Impact

A client's e-shop before and after Cloudflare WAF: | Metric | Before | After | |--------|------|--------| | Brute force attempts/day | 12,000 | 50 | | Spam comments/week | 800 | 5 | | Server CPU usage | 70% | 40% | | Page load time | 2.4s | 1.6s |

Plus, it successfully mitigated two DDoS attacks.

Summary

A WAF is mandatory in 2026, even for small websites. The free version of Cloudflare provides 80% protection for £0. Our security service includes WAF configuration and monitoring. Request a quote.

Sources

• OWASP Top 10
• Cloudflare – What is a WAF?
• Sucuri – Website Firewall