Web Application Firewall (WAF)

A WAF is deployed to protect a specific web application or set of web applications, and it can be considered a reverse proxy. Proxies generally protect clients, while WAFs protect servers. A WAF can take the form of an appliance, a server plugin, or a filter.

WAFs are a class of firewall that has been in use since web applications were first accessed through web protocols such as HTTP. They can inspect traffic for SQL injection, operating system command injection, and cross-site scripting attacks and prevent inbound attacks. Some detect traffic from malicious URLs. WAFs are also used in content delivery networks and to prevent distributed denial-of-service (DDoS) attacks.

Web application and API protection (WAAP) builds on the WAF, and the WAF is an integral component of API security, bot defense, and DDoS protection. WAAP can be offered as a product suite or as a cloud-based service.

A WAF can be customized to the application it protects. That customization can take significant effort, and it needs to be maintained as the application changes.