What is a web application firewall (WAF)?
By Ash, Founder, HosteazePublished 2 min read
The short answer
A web application firewall (WAF) sits between your website and its visitors, inspecting every web request and blocking the ones that look like attacks, such as SQL injection, cross-site scripting or login floods. It protects the application itself, like WordPress or a shop, which an ordinary network firewall doesn't look at closely.
A normal firewall is like a bouncer checking which door you're using. A web application firewall reads what you're carrying. It inspects the contents of each request to your website, the form fields, the address and the headers, and turns away anything that looks like an attack before your site has to deal with it.
What does a WAF actually block?
OWASP, the non-profit that tracks web security risks, describes a WAF as a set of rules applied to each HTTP conversation, usually aimed at common attacks. In practice, that means things like:
- SQL injection, where an attacker types database commands into a search box or form hoping your site runs them.
- Cross-site scripting (XSS), where someone tries to plant code that runs in your visitors' browsers.
- Requests for known vulnerable files, such as an old plugin with a published security hole.
- Login floods, where a bot tries thousands of passwords against
/wp-login.php.
Injection is still on the OWASP Top 10:2025 list of the most serious web application risks, which tells you how often sites get this wrong.
What types of WAF are there?
| Type | Where it runs | Pros | Cons |
|---|---|---|---|
| Cloud or DNS-based | A service in front of your site, via a DNS change | Blocks attacks before they reach your server; often adds a CDN | Another service to manage and pay for |
| Server-level | On the web server, such as ModSecurity | Covers every site on the server; the host maintains it | You usually can't fine-tune the rules yourself |
| Plugin-level | Inside WordPress as a security plugin | Easy to install; understands WordPress | Runs after the request reaches your site, using its resources |
Many hosts run a server-level WAF using ModSecurity with the OWASP Core Rule Set (CRS), a free set of attack detection rules. It's worth asking your host whether they do.
Does a WAF make my site secure?
It makes it harder to break, which isn't the same thing. A WAF can't fix a weak admin password, an abandoned plugin or a missing backup. Think of it as a seatbelt, not a reason to drive badly. Pair it with DDoS protection for traffic floods, and work through our guide on how to protect a website from hackers for the rest.
More plain-English guides are in Email and domains.
Frequently asked questions
Do I need a WAF for a small WordPress site?
It's a useful extra layer, not a replacement for the basics. Keeping WordPress, themes and plugins updated and using strong, unique passwords with two-factor login does more. A WAF earns its place by blocking attacks on flaws you haven't patched yet.
Can a WAF block real visitors by mistake?
Yes. These are called false positives, for example a contact form message that happens to contain code-like text. Good WAFs let you or your host switch off a single rule for a specific page, and the OWASP Core Rule Set is designed to keep false alerts to a minimum.
Is a WAF the same as DDoS protection?
No, though some services offer both. A WAF looks at what each request contains. DDoS protection deals with the sheer volume of traffic, which can knock a site offline even if every request looks harmless.