Home / Knowledge hub / WAF
Knowledge hub
WAF
A filter in front of your application that blocks known bad requests.
What it means
A WAF, or web application firewall, sits in front of your application and inspects requests before they arrive. It blocks the ones matching known bad patterns.
Most are a hosted service you route traffic through. Cloudflare describes its own as filtering requests against sets of rules called rulesets. The OWASP Core Rule Set is the open collection many of them grew from.
Why it matters
It buys time, and time is worth buying. When a flaw appears in something you run, a rule at the edge holds the line while your team prepares and ships the fix.
It also clears out the constant background of low effort automated attempts, which makes your logs readable and your alerts worth reacting to. Rules need attention, though. Left at their defaults a firewall blocks little. Tuned too tightly it starts blocking customers, and somebody notices that within the hour. Rules need a person as well as a subscription.
How it shows up
State the limit plainly, because this is where confidence goes wrong. A firewall does nothing about a flaw in your own business rules. A request that changes an id in a URL to somebody else's, or applies a discount twice, looks entirely legitimate. There is no bad pattern to match.
Treat it as one layer beside the check the application should be doing itself. Cyberlop does not grade your firewall or its rules, and it makes no claim about your network. Watch what a rule lets you postpone, though. Somebody writes a rule to stop one pattern and calls it the fix. The ticket closes, and the flaw is still there when the same request arrives in a different shape.
Questions people ask
WAF, answered
Do I still need a WAF if my code is solid?
It still earns its place, mostly for the hours you do not control. A rule at the edge can hold off a published library flaw while you test and ship the upgrade.
Think of it as a layer that buys time, not as a reason to skip the check in your own code.
Will a WAF stop business logic attacks?
No. A logic attack uses legitimate requests in an order or a quantity you never intended, so no signature exists to match.
Applying a discount twice, skipping a payment step, changing a record id: each request looks perfectly normal on its own.
Will a WAF block real customers?
Sometimes, yes. Every ruleset produces false positives, and the ones that hurt tend to involve uploads, rich text and unusual characters in names.
Run new rules in log-only mode first, watch what they would have blocked, then enforce. Budget real time for tuning.
Is a WAF the same as a network firewall?
No. A network firewall decides which ports and addresses may talk to each other. A web application firewall reads the HTTP request itself, including paths, headers and body.
They answer different questions, and having one says nothing about the other.
Can a WAF rule count as fixing a vulnerability?
It counts as buying time, which is worth recording as exactly that. The flaw is still in the code, and a different encoding or a different route often gets past the rule.
Keep the ticket open until the application itself rejects the request.
Related
Terms that sit next to this one
Firewall
A control deciding which traffic is allowed to reach a system.
Rate limiting
Capping how often something can be attempted, per user or per address.
Business logic flaw
Nothing is technically broken, but your own rules turn against you.
Mitigation
Reducing what a vulnerability can do without actually fixing it.
Defence in depth
Assume any one control will fail, and have something else behind it.
Firewall on, business rules untested?
A filter cannot see a request that looks legitimate. Cyberlop tests authorisation today, and the business-logic module ships 4 January 2027. Ask what a run covers right now.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.