What is WAF?

WAFs operate at Layer 7 of the OSI model, which gives them visibility into the actual content of a web request rather than just source IP and destination port. A SQL injection payload embedded in a login form field, something like a crafted string that closes a quoted parameter and appends a UNION SELECT clause, looks like ordinary port-443 traffic to a network firewall but is immediately recognizable to a WAF parsing the query string and POST body against known attack patterns. The same is true for reflected cross-site scripting, where a malicious script tag is injected into a URL parameter and echoed back into the page unescaped, or path traversal, where an attacker manipulates a file-path parameter with sequences like ../../ to read files outside the intended web root.

Deployment modes vary by architecture: reverse proxy mode routes all client traffic through the WAF before it reaches the application, transparent bridge mode inspects traffic inline without changing IP addressing, and cloud-delivered WAFs (Cloudflare, AWS WAF, Akamai) sit at the CDN edge, filtering traffic before it ever reaches origin infrastructure. Detection combines signature rulesets, most commonly the OWASP Core Rule Set, which encodes known attack patterns for injection, XSS, and other OWASP Top 10 categories, with rate limiting to blunt credential-stuffing and scraping bots, and increasingly behavioral profiling that flags a client issuing requests in a pattern no human browser session would produce.

Modern WAF platforms have extended into dedicated API security, since APIs expose structured input directly to attackers without the guardrails a rendered HTML form provides. API-aware WAF modules enforce schema validation against an OpenAPI spec, reject requests with unexpected fields or types, and detect parameter tampering such as an ID field manipulated to access another user's record (broken object-level authorization, a leading cause of API breaches). Like an IPS, a WAF has to be tuned carefully: overly aggressive rules block legitimate users (a false positive that shows up as a support ticket), while overly permissive rules let real attacks through as false negatives, so most WAF rollouts start in monitoring-only mode to baseline traffic before flipping to active blocking.