Web Application Firewalls, Done Properly
A filtering layer that inspects HTTP traffic and blocks requests matching known attack patterns.
Marcus Adeyemi
Why does it matter?
A firewall buys time against known attacks, but it is a layer of defense rather than a substitute for secure code.
What are the numbers?
- Rule sets managed rules cover common attack classes
- False positives legitimate requests can be blocked
- Tuning rules need adjusting per application
- Visibility logs show attempted attacks
What should I do?
- Start in monitoring mode before blocking
- Tune rules against real traffic
- Review blocked request logs
- Keep managed rule sets updated
- Fix underlying vulnerabilities regardless
What should I avoid?
Avoid:
- Blocking mode with untuned rules
- Treating a firewall as a substitute for secure code
- Ignoring false positive reports
- Rules nobody reviews
When should I get help?
Short answer Bring in help when applications face active attacks.
Where this comes from
- OWASP — Web Application Firewall
- Cloudflare Learning Center — What is a WAF?
The figures and practices above come from the sources listed.
Working on something like this?
We take on Web Design & Development work for teams who want it done once, properly. Tell us what you are building and we will tell you honestly whether we are the right studio for it. Start a project.
Where to go next
Spotted something wrong? Report an error on this page. We correct on the page and say what changed.
