Web application firewalls (WAF)
A web application firewall inspects HTTP and HTTPS requests before they reach an application and blocks the ones that look like attacks: SQL injection, cross-site scripting, remote file inclusion, abusive bots and request floods. Our team deploys WAFs at the edge in front of customer websites, portals and APIs, and tunes them so they stop attacks without blocking real customers.
What we do
- Edge WAF deployment in front of websites, portals and APIs
- Detection-mode baselines before blocking is turned on
- Custom rules for the application's own login, upload and admin paths
- Rate limits against credential stuffing, scraping and request floods
- Bot management settings that separate good, unknown and bad bots
- Policy scopes: one baseline policy with domain or route exceptions
- WAF log export to the SIEM and alerting on blocked attacks
- Rule reviews after each application release
Every WAF we run starts in detection mode. We review what the managed rules would have blocked, add exceptions for legitimate traffic, write custom rules for the application's own weak points, and only then switch to prevention. Rate limits protect login pages, password resets and expensive API calls from credential stuffing and scraping.
A WAF is one layer, not a replacement for patching or secure code. It pairs with our DDoS protection, DNS, load balancer and logging work: WAF events flow into the SIEM, so the security team sees blocked attacks next to the rest of the evidence.
Leading platforms we work with
- Cloudflare WAF
- AWS WAF
- Azure Web Application Firewall on Azure Front Door
- Akamai App & API Protector
Platforms and practices
- Managed rule sets
- Custom rules
- Rate limiting rules
- Bot protection
- Detection and prevention modes
- WAF logging to the SIEM
- Google Cloud Armor
- OCI Web Application Firewall
References
- Cloudflare: Web Application Firewall documentation
- AWS: AWS WAF
- Microsoft Learn: Azure Web Application Firewall on Azure Front Door
- Akamai: App & API Protector (vendor page)
- Google Cloud: Cloud Armor
- Oracle: OCI Web Application Firewall
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Web application firewalls (WAF) for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn more