What Is a Web Application Firewall and Do I Need One?

A web application firewall (WAF) sits in front of your website and inspects every HTTP request, blocking ones that match known attack patterns, such as SQL injection, cross-site scripting and malicious bots, before they reach your server. Most small business sites benefit from one, and a basic WAF is now available free from CDNs or included by many hosts.

This guide explains how a WAF works, what it does and doesn't protect against, the main types and costs, and how to switch one on without breaking your site.

Key takeaways

A WAF inspects every HTTP request and blocks attacks such as SQL injection, cross-site scripting and bad bots before they reach your site.
Most small business sites benefit from one, and a basic WAF is available free from CDNs or included by many hosts.
A WAF does not replace software updates or two-factor authentication, as it cannot stop stolen passwords or fix outdated plugins.
Restrict your origin to your CDN's published IP ranges, otherwise attackers can reach your server directly and bypass a cloud WAF.

How does a web application firewall work?

OWASP describes a WAF as "an application firewall for HTTP applications" that "applies a set of rules to an HTTP conversation". Unlike a network firewall, which decides based on IP addresses and ports, a WAF reads the content of each request: the URL, query string, headers, cookies and form data.

For each request it does one of three things:

Allow it through to your site.
Block it and return an error page.
Challenge it, for example with a browser check, to filter out bots.

Rules come from three sources: managed rulesets maintained by the WAF vendor, generic rulesets such as the OWASP Core Rule Set (CRS), and custom rules you write yourself ("block requests to /wp-login.php from outside the countries you sell to", "rate-limit the contact form").

What does a WAF protect against?

A good managed ruleset targets the attack classes that hit small sites every day:

Injection attacks: SQL injection, command injection and code injection through forms and URLs.
Cross-site scripting (XSS): script tags and event handlers smuggled into input fields.
File inclusion and path traversal: attempts to read ../../etc/passwd or load remote files.
Known CMS and plugin exploits: vendors push "virtual patches" for widely exploited vulnerabilities, often within hours of disclosure.
Bad bots and scanners: automated tools probing for /.env, /wp-config.php.bak and admin panels.
Brute-force logins and abuse: with rate limiting, repeated login or form submissions from one source.

The OWASP CRS, for example, covers SQL injection, cross-site scripting, local and remote file inclusion, code and shell injection, session fixation and scanner detection.

What doesn't a WAF protect against?

A WAF is a filter, not a fix. It won't help with:

Stolen or weak passwords. A correct login looks like a normal request. Two-factor authentication is the control that matters here.
Out-of-date software. Virtual patches buy time; they don't replace updating the plugin.
Business logic flaws, such as a coupon that can be applied twice.
Misconfiguration, like a public backup file or missing security headers.
Attacks that bypass it. If attackers can reach your server's IP address directly, they skip a cloud WAF entirely.

OWASP also notes that tailoring a WAF to an application "can be significant and needs to be maintained as the application is modified". Expect some tuning.

What types of WAF are there?

Type	Where it runs	Typical cost for a small site	Pros	Cons
Cloud/CDN WAF	Provider's edge network in front of your site	Free tier to tens of pounds a month	Blocks traffic before it reaches your host, easy to set up, combined with CDN and DDoS protection	Needs DNS changes; origin must be locked down to be effective
Host-level WAF	Your host's web server (often ModSecurity with CRS or a vendor ruleset)	Often included	Nothing to configure, protects every site on the account	Little control; false positives need a support ticket
Application plugin	Inside your CMS, e.g. a WordPress security plugin	Free to paid	Understands the CMS, adds login protection	Runs after the request has reached PHP, so uses server resources
Self-managed	Your own server (ModSecurity or Coraza with OWASP CRS)	Free software, your time	Full control	Requires skills to tune and maintain

For most small businesses, a cloud WAF in front of the site, plus whatever your host provides, is the best balance.

Do I need a WAF for my small business website?

You probably do if any of these apply:

You run WordPress, Joomla, Drupal or another popular CMS with plugins.
You have login areas, forms, search boxes or a shop.
You've seen spikes in spam submissions or failed logins.
You can't guarantee updates are applied within days of release.

You may get less value if your site is entirely static HTML hosted on a modern platform with no forms or logins, though a free CDN WAF still costs nothing.

If you take card payments on your own site rather than through a hosted payment page, PCI DSS v4 includes a requirement (6.4.2) for an automated solution, such as a WAF, in front of public-facing web applications. Check with your payment provider which requirements apply to you; most small shops using a hosted checkout have a much smaller scope.

How do I set up a free WAF?

Using Cloudflare as an example (other CDNs have similar steps):

Add your domain to Cloudflare, switch your nameservers and make sure your web records are proxied.
In the dashboard's WAF managed rules section (under Security), check the Cloudflare Free Managed Ruleset is enabled. It's available on every plan; the fuller Cloudflare Managed Ruleset and OWASP Core Ruleset need Pro or above.
Add a custom rule or rate-limiting rule for your login URL.
Set SSL/TLS to Full (strict) so traffic to your origin stays encrypted.
Restrict your origin so it only accepts web traffic from your CDN's published IP ranges, or use a tunnel, so attackers can't bypass the WAF.
Watch the security events log for a week and adjust any rule that blocks genuine customers.

If you'd rather not change DNS, ask your host whether ModSecurity or an equivalent is enabled on your plan.

How do I avoid false positives?

Start rules that you write yourself in a log or challenge mode, review events, then switch to block. Common culprits are page builders posting large HTML, payment provider webhooks and staff pasting code into a CMS. Add narrow exceptions (a specific path and rule) rather than switching the WAF off.

What to do next

Check whether your host already runs a WAF, then decide whether to add a cloud WAF in front. Pair it with the basics a WAF can't provide: security headers, updates and 2FA. Our WordPress security checklist covers the CMS side. To see what attackers' scanners see, MakeItFlow's free website security scan checks for exposed .env and .git files, missing headers and cookie flags, and MakeItFlow technology detection shows which CMS and plugins your site reveals publicly.

Frequently asked questions

Is a WAF the same as a firewall on my server?

No. A server or network firewall controls which ports and IP addresses can connect. A WAF understands HTTP and inspects the content of web requests. You want both.

Will a WAF slow my website down?

A cloud WAF usually adds negligible latency, and when combined with a CDN it often makes the site faster overall. Plugin-based WAFs run on your server and can add load on busy sites.

Does a WAF stop DDoS attacks?

It helps with application-layer floods by rate-limiting and challenging abusive traffic, but large network-level attacks need dedicated DDoS protection. Many CDNs include both.

Can a WAF replace software updates?

No. Virtual patches reduce risk between disclosure and your update, but attackers can find ways around rules. Update the vulnerable software as soon as you can.

Do WordPress security plugins include a WAF?

Several do. They're useful for login protection and CMS-specific rules, but because they run inside WordPress, malicious requests have already reached your server. A cloud WAF stops them earlier.

Does a Small Business Website Need DDoS Protection?: Does a small business website need DDoS protection? Usually a free CDN layer is enough. Learn the real risks, what your host covers and how to prepare cheaply.
Post-Quantum Encryption for Websites: What Small Businesses Need: Post-quantum encryption for websites: harvest now, decrypt later, hybrid X25519MLKEM768 key exchange, NCSC timelines and the steps a small business needs.
Best Cloudflare Free Plan Settings for a Small Business Site: The best Cloudflare free plan settings for a small business: SSL mode, HTTPS, HSTS, TLS, caching, cache rules, bot and AI controls, WAF and DNS, step by step.