Web Application Firewall (WAF): Complete Setup & Configuration Guide
Key Takeaways
- A WAF (Web Application Firewall) protects against application-layer attacks: SQL injection, XSS, file inclusion, credential stuffing, and API abuse.
- WAF operates at Layer 7 - it inspects HTTP/HTTPS request content, unlike traditional firewalls that only filter network packets.
- Combine WAF with DDoS protection and bot management for comprehensive security, each addressing different attack layers.
- Start with managed rulesets (OWASP CRS, Cloudflare Managed Rules) and add custom rules based on your application's specific attack patterns.
- Monitor mode first: Deploy new WAF rules in log/monitor mode before blocking, false positives can break legitimate functionality.
Table of Contents
Your website faces hundreds of automated attacks daily, SQL injection probes, XSS payloads, credential stuffing attempts, and exploit scanners. A Web Application Firewall (WAF) is the security layer that inspects every HTTP request, detects malicious patterns, and blocks attacks before they reach your application.
What Is a WAF?
A WAF sits between your web traffic and your application, analysing every HTTP/HTTPS request against a set of security rules. It's distinct from network firewalls (which filter by IP/port) and IDS/IPS systems (which monitor network packets). WAFs understand web protocols, they can inspect URL parameters, request bodies, cookies, headers, and file uploads for malicious content.
How a WAF Works
Positive Security Model (Allowlisting)
Defines what legitimate requests look like and blocks everything else. Most secure but requires extensive configuration for each application endpoint.
Negative Security Model (Blocklisting)
Maintains a database of known attack signatures and blocks matching requests. Easier to deploy but can't catch zero-day attacks. Most managed rulesets use this approach.
Anomaly Scoring
Assigns points for each suspicious characteristic. When a request's total score exceeds a threshold, it's blocked. This approach (used by OWASP Core Rule Set) reduces false positives by requiring multiple suspicious signals.
Protecting Against OWASP Top 10
| OWASP Vulnerability | WAF Protection | Rule Type |
|---|---|---|
| SQL Injection | Detect SQL syntax in parameters, headers, cookies | Managed + Custom |
| XSS (Cross-Site Scripting) | Block script tags, event handlers, encoded payloads | Managed |
| Broken Authentication | Rate limit login endpoints, detect credential stuffing | Custom + Rate Limiting |
| Server-Side Request Forgery | Block internal IP requests, validate URLs in parameters | Custom |
| Security Misconfiguration | Block access to admin panels, config files, .env files | Custom |
| File Inclusion (LFI/RFI) | Detect path traversal patterns (../, etc.) | Managed |
| XML External Entity (XXE) | Inspect XML payloads for entity declarations | Managed |
WAF Types
| Type | Examples | Best For | Pros/Cons |
|---|---|---|---|
| Cloud-based WAF | Cloudflare, AWS WAF, Akamai | Most websites and APIs | Easy deployment, scales automatically, CDN included / Less customisable |
| Host-based WAF | ModSecurity, NAXSI | Self-managed servers | Full control, open source / Requires expertise, manual updates |
| Network-based WAF | F5 BIG-IP, Fortinet FortiWeb | Enterprise data centres | Lowest latency, hardware-accelerated / Expensive, complex deployment |
Cloudflare WAF Configuration
Cloudflare WAF is the most popular cloud WAF, included with Pro (£20/mo) and above plans:
- Cloudflare Managed Ruleset: Pre-configured rules for common attacks, updated by Cloudflare's security team
- OWASP Core Rule Set: OWASP ModSecurity CRS adapted for Cloudflare's platform
- Custom Rules: Write your own rules using Cloudflare's expression language (Wirefilter)
- Rate Limiting Rules: Throttle or block excessive requests to specific endpoints
- IP Access Rules: Allow or block specific IPs, IP ranges, ASNs, or countries
Writing Custom WAF Rules
Block Access to Sensitive Files
Block requests to configuration files, environment files, and admin paths that shouldn't be publicly accessible (.env, .git, wp-admin, phpMyAdmin, etc.).
Protect Login Endpoints
Apply strict rate limiting to login, registration, and password reset endpoints. Combine with bot management to block credential stuffing attacks.
Geographic Restrictions
If your application serves specific regions, block or challenge traffic from unexpected countries, especially for admin panels and APIs.
Rate Limiting and Throttling
Rate limiting is one of the most effective WAF techniques:
- Global rate limit: Max requests per IP per minute across the entire site
- Endpoint-specific limits: Stricter limits on sensitive endpoints (login, API, search)
- Progressive limits: Softer challenge (CAPTCHA) first, then hard block on continued abuse
- Bot score-based limits: Lower thresholds for low bot scores, higher for verified humans
Integrating WAF with DDoS & Bot Protection
WAF works best as part of a layered security stack:
- CDN/Anycast network: Absorbs volumetric DDoS attacks
- DDoS protection: Handles L3/L4 protocol attacks
- WAF: Filters L7 application attacks (SQL injection, XSS, etc.)
- Bot management: Identifies automated threats using fingerprinting and behavioural analysis
- Rate limiting: Constrains abuse from individual sources
WAF Solutions Compared
| Solution | Best For | Pricing |
|---|---|---|
| Cloudflare WAF | Most websites, integrated CDN+DDoS+WAF+Bot | From 0/mo (Pro) |
| AWS WAF | AWS-hosted applications | $5/mo + $0.60/million requests |
| Akamai App & API Protector | Enterprise, high-traffic sites | Enterprise pricing |
| Imperva WAF | Compliance-heavy industries (PCI-DSS) | From $$$ |
| ModSecurity (open source) | Self-managed servers, full control | Free (self-managed) |
| Sucuri WAF | WordPress sites, small businesses | From £9.99/mo |
WAF Best Practices
- Deploy in monitor mode first: Log blocked requests without actually blocking, review for false positives before enforcing
- Tune rules for your application: Generic rulesets cause false positives. Whitelist legitimate patterns specific to your app.
- Update regularly: New vulnerabilities emerge daily, keep managed rulesets updated
- Monitor WAF logs: Review blocked requests to identify attack trends and tune rules
- Don't rely on WAF alone: WAF is one layer, combine with secure coding, patching, and infrastructure hardening
- Test with security scanners: Use OWASP ZAP or Burp Suite to verify your WAF catches expected attacks
Need Security Infrastructure Setup?
Our team configures WAF, DDoS protection, bot management, and security monitoring for websites and applications. Complete protection from application to network layer.
Get Security Consultation →
Comments
Have a question or a first-hand experience with this? Join the conversation. Your email is never shown or shared.
Great article. Any case studies showing ROI?
Great question! This is something we see frequently with our clients. The key is consistency rather than a one-time fix.