# Web application firewalls explained

> A web application firewall (WAF) sits in front of a website or API and inspects every HTTP request. It blocks attacks such as SQL injection, cross-site scripting, credential stuffing and malicious bots before they reach your server. Most teams now use a cloud WAF from a provider such as Cloudflare, AWS, Akamai or Imperva, and the hard part is tuning and running it.

This site is run by Vigilbase (https://vigilbase.com), a managed security provider. It covers: web application firewall.

## What a WAF blocks

- Injection attacks: SQL injection, command injection and similar payloads in forms, URLs and headers.
- Cross-site scripting attempts.
- Known exploits for popular software, through managed rules updated by the provider.
- Credential stuffing and abusive bots, through rate limits and bot scoring.
- Layer 7 DDoS floods, when the WAF runs on a large edge network.

## Types of web application firewall

- Cloud or edge WAF: runs on the provider's network in front of your site. Quick to deploy and absorbs large attacks. Examples: Cloudflare, AWS WAF, Akamai, Imperva, Fastly.
- Appliance or virtual WAF: runs in your data centre or cloud account. More control, more upkeep. Examples: F5, Fortinet FortiWeb.
- Host-based WAF: a module on the web server, such as ModSecurity. Cheap but adds load and needs expert rules.

## WAF types compared

|  | Cloud / edge WAF | Appliance or virtual WAF | Host-based WAF |
| --- | --- | --- | --- |
| Where it runs | Provider's global network | Your data centre or cloud account | On the web server |
| Absorbs DDoS | Yes | Limited by your bandwidth | No |
| Set-up | DNS change | Deploy and size hardware or VMs | Install a module |
| Rule updates | Managed by provider | Vendor feeds, you apply | You maintain |
| Best for | Most websites and APIs | Strict on-premises requirements | Small, single-server sites |

## How to choose a WAF

- Coverage: managed rules for the software you run, API protection and bot management.
- False positives: how easily you can see and fix blocks that hit real customers.
- Operations: who writes rules, reviews events and responds to an attack at 3am.
- Performance: whether the same network also caches and speeds up the site.
- Cost: per-request pricing can rise sharply during an attack. Check what is included.

## A WAF still needs someone to run it

Out-of-the-box rules stop common attacks, but every site needs tuning: allow lists for partners, rate limits for login and checkout, and quick changes during an incident. That is why many teams buy a managed WAF.

Vigilbase Shield is a managed Cloudflare WAF. Vigilbase is a Preferred Cloudflare Partner and configures the rules, watches the traffic and changes protection when attacks happen, with follow-the-sun support around the clock.

## FAQ

### What is the difference between a firewall and a web application firewall?

A network firewall filters traffic by IP address and port. A web application firewall reads the content of HTTP requests and blocks attacks hidden in them, which a network firewall cannot see.

### Do I need a WAF if my site is on a managed host?

Usually yes. Hosts patch the server, but your application, plugins and login pages are still exposed. A WAF blocks exploit attempts and bots in front of them.

### Will a WAF slow down my website?

A cloud WAF on a large edge network adds little delay and often makes the site faster, because the same network caches content close to visitors.

### What is a managed WAF?

A WAF that a specialist configures and operates for you, including rule tuning, monitoring and response during attacks. Vigilbase Shield is one.

## Related

- [See Vigilbase Shield](https://vigilbase.com/shield)
- [Compare WAF and edge providers](https://vigilbase.com/comparisons/cloudflare/alternatives)
- [Vigilbase Shield (managed WAF)](https://vigilbase.com/shield)
- [Vigilbase OS (security operations)](https://vigilbase.com/os)
- [Managed SOC](https://vigilbase.com/managed-soc)
- [DDoS protection](https://vigilbase.com/cloudflare/ddos-protection)
- [Free security tools](https://vigilbase.com/tools)