WAF (web application firewall)

A WAF, short for web application firewall, sits between the internet and a website’s actual code, looking at every incoming request and deciding whether it looks like normal traffic or an attempt to exploit something. Where DDoS protection deals with sheer volume, a WAF deals with intent. It is not trying to catch a flood. It is trying to catch the one request out of a million that is crafted to trick a form, break a database query, or find a weakness in how a site handles input.

Most of what a WAF blocks, a business owner will never see and never need to think about. Attackers run automated tools that probe thousands of sites a day for common weaknesses. A WAF recognises the patterns those tools use and stops them at the door.

Why it matters to you

A lot of website compromises are not sophisticated. They are automated scripts trying the same known tricks against every site they can find, on the assumption that some percentage will not be defended. A WAF closes that door regardless of whether anyone has specifically targeted your site. You are protected by default, not because someone decided you were worth attacking.

It matters more, not less, if a site handles any kind of input from visitors, a contact form, a booking request, a search box. Every one of those is a place where a malicious request could try to do something it should not. A WAF checks that traffic before it ever reaches the code that processes it.

How I set it up

The sites I build sit behind Cloudflare, and the WAF runs as part of that, inspecting traffic before it reaches the site’s own logic. I do not manage a separate firewall product or maintain a list of rules by hand. It works alongside the security headers sent with every page and the DDoS protection that handles volume, so the site has more than one layer looking at incoming traffic, each catching a different kind of problem.

Because the sites themselves are built as static files with nothing to break into, a WAF is one layer among several, not the only thing standing between an attacker and the site. That combination matters more than any single piece of it.

What it looks like in practice

You will not interact with a WAF, and on a healthy site you will never know it stopped anything. What exists instead of a visible feature is an absence: no defaced page, no injected script, no strange redirect that someone else planted. The WAF’s whole job is to make sure nothing interesting ever happens for you to notice.