Home/Web Application Firewall

Application protection

Protection for the part of your business customers actually touch.

A web application firewall inspects the requests reaching your website, application or API and applies policy before your application is asked to handle them.

Talk to security support Network security
  • Covers websites, applications and APIs
  • Request-level inspection of HTTP and HTTPS traffic
  • Policy tuned to your application
Web application firewall in front of a website and APICustomer and API requests pass through a web application firewall that inspects HTTP and HTTPS traffic against a rule set. A malicious request is stopped at the firewall while valid requests continue to the website and the application API.VISITORSCustomersAPI clientsVALID REQUESTAPI CALLMALICIOUS REQUESTWeb applicationfirewallINSPECTS HTTP/HTTPSREQUESTS AND RESPONSESRULES + POLICYWebsitePAGES + CHECKOUTApplication + APIBUSINESS LOGIC
Requests inspected before they reach the application

What it protects

Anything that answers a request from the internet.

If it has a URL and accepts input, it is worth protecting at the request level.

Websites

Public sites, marketing pages, portals and anything else serving content to visitors.

Web applications

Logged-in products, dashboards, booking systems and internal tools exposed to the internet.

APIs

Endpoints built for machine access, which attract automated traffic by design.

E-commerce platforms

Product pages, carts and checkout flows where the cost of downtime is immediate.

Online services

Subscription products, member areas and anything else your customers sign in to.

Login and account flows

The paths that attract credential-stuffing and automated abuse before anything else does.

Network firewall vs web application firewall

Two different doors, two different guards.

This is the question we are asked most, so it is worth answering directly rather than in a comparison table nobody reads.

Network firewall compared with a web application firewallSide-by-side comparison. A network firewall guards the way in and out of a network, looking at addresses and ports, connections and sessions, and devices and sites. A web application firewall guards requests reaching a web application, looking at page and form requests, API calls, and login and checkout flows. Most organisations use both.Network firewallGuards the way in and out of a networkWHAT IT LOOKS ATAddresses and portsConnections and sessionsDevices and sitesWeb application firewallGuards the requests reaching a web appWHAT IT LOOKS ATPage and form requestsAPI callsLogin and checkout flowsANDMOST ORGANISATIONS USE BOTH — THEY PROTECT DIFFERENT THINGS
Different layers, different questions

How it works

Every request gets read before your application sees it.

Requests arriving at your site pass through the WAF first. Each one is evaluated against a rule set tuned to your application: what a valid request looks like, which patterns are associated with known attack techniques, and what should happen to the rest.

Valid traffic continues to the application. Requests that match a block rule are stopped and recorded, so the decision can be reviewed and the rule adjusted if needed.

A layer, not a substitute

Request-level protection reduces exposure to common attack patterns. It does not replace secure development practice, patching or sound application design.

Web application firewall in front of a website and APICustomer and API requests pass through a web application firewall that inspects HTTP and HTTPS traffic against a rule set. A malicious request is stopped at the firewall while valid requests continue to the website and the application API.VISITORSCustomersAPI clientsVALID REQUESTAPI CALLMALICIOUS REQUESTWeb applicationfirewallINSPECTS HTTP/HTTPSREQUESTS AND RESPONSESRULES + POLICYWebsitePAGES + CHECKOUTApplication + APIBUSINESS LOGIC
Valid requests continue; blocked requests are recorded

FAQ

Web application firewall questions.

What is the difference between a network firewall and a WAF?

A network firewall controls the way in and out of a network: addresses, ports, connections and devices. A web application firewall inspects the requests arriving at a website or application — form submissions, API calls, login attempts — and decides which ones the application should be asked to handle. They protect different things and are commonly used together.

Do I need a WAF if my site is already on HTTPS?

HTTPS encrypts traffic in transit, which protects it from being read or altered on the way. It does not assess whether a request is legitimate. A WAF looks at the content of the request itself, which is a separate question.

Does it protect APIs as well as web pages?

Yes. APIs are a common target precisely because they are designed for automated access. API endpoints can be protected under the same policy as the rest of the application, with coverage depending on your configuration.

Will legitimate customers be blocked?

Rules are tuned to your application, and actions are recorded so a decision can be reviewed and adjusted. Some tuning after launch is normal, especially for applications with unusual request patterns.

Does it work with e-commerce platforms?

Web application protection is designed for websites, applications, APIs and online services, including commerce platforms. What is required in your case depends on how your site is hosted and built.

Does it replace secure development?

No, and it should not be presented that way. A WAF reduces exposure to common request-level attack patterns; it does not correct flaws in application code. It is a layer, not a substitute.

Next step

Protect the site your customers rely on.

Tell us what you run — a website, an application, an API, or all three — and we will explain what request-level protection would cover.

Talk to security supportSee all services