A Web Application Firewall (WAF) inspects the HTTP requests coming into your website and blocks the ones that look like attacks — before they reach your application code. Where a network firewall decides which ports and IPs can connect, a WAF looks inside the request itself: the URL, the headers, the parameters and the body.
What a WAF Actually Blocks
- SQL injection: input crafted to trick your database into running attacker commands.
- Cross-site scripting (XSS): scripts injected to run in other users' browsers.
- Path traversal and file-inclusion attempts that try to read files they shouldn't.
- Known bad bots, scanners and exploit patterns probing for vulnerabilities.
A WAF matches each request against a set of rules — signatures of known attack patterns, plus scoring for suspicious combinations — and blocks, challenges or logs anything that crosses a threshold.
How a WAF Works
Most modern WAFs run at a reverse proxy in front of your application, so every request passes through them before reaching your server. Rules can run in blocking mode (reject the request outright) or learning mode (log what would have been blocked, so you can tune before enforcing). Good WAFs let you adjust sensitivity per rule class and whitelist false positives, because a WAF that blocks legitimate traffic is worse than none.
A WAF is not a DDoS defence
A WAF stops malicious-looking requests; it does not, on its own, stop a flood of ordinary-looking ones. Ten thousand valid requests per second will pass a WAF's content checks while still overwhelming your server. WAF and DDoS protection solve different problems — you want both, working together.
WAF vs DDoS Protection vs Network Firewall
- Network firewall: controls which IPs and ports can connect. Layer 3/4. Doesn't understand HTTP.
- DDoS protection: absorbs or filters floods of traffic, whether malicious in content or just overwhelming in volume.
- WAF: inspects the content of each HTTP request and blocks attack patterns. Layer 7.
How Akarguard Fits
Akarguard is a Layer 7 reverse proxy that combines both: a WAF (based on Naxsi) you manage from the dashboard — with per-category rules, sensitivity control, a live detections view and one-click false-positive whitelisting — plus application-layer DDoS filtering, challenges and rate limits. The proxy filters the flood; the WAF inspects the requests that get through. You enable it all with a single DNS change.