Web application firewall (WAF): what it does, and who really needs one
A web application firewall sits in front of a web application and filters the attacks aimed at that application, rather than at the network around it. Whether you need one depends on what you expose to the Internet, the technology behind it and the risk involved: for many SMBs, it is not the first priority.
- A WAF protects a specific web application. A traditional firewall protects a network boundary. They are not the same thing.
- It becomes useful as soon as you expose an application publicly: client portal, online store, extranet, a form that writes to a database.
- Without a public application, it adds nothing. We'll tell you so rather than sell you one.
What a WAF actually does
A web application constantly receives requests from the Internet. The vast majority are legitimate; a small share try to make it do something it was never meant to do — read a database, bypass authentication, inject code that will run in another visitor's browser.
The WAF reads these requests before they reach the application and blocks those that match known attack patterns. It works on the content of the request, not on the address it comes from.
How it differs from a traditional firewall
| Network firewall | Web application firewall (WAF) | |
|---|---|---|
| What it protects | The network boundary | A specific web application |
| What it looks at | Addresses, ports, protocols | The content of the request |
| The question it asks | Is this connection allowed in? | Is this request trying to hijack the application? |
| What it can't see | What happens inside an authorized request | Anything that doesn't go through the application |
| Who needs it | Every business with a network | Those that expose a public application |
A business with a public web application generally needs both, and they are not interchangeable. It's the most common confusion on this topic.
Who needs one, and who doesn't
- You need one if you expose an application. Client portal, online store, supplier extranet, member area, or any public form that writes to a database.
- You need one if the application handles personal information. Quebec's Law 25 doesn't name any technology, but an application that handles client data is a place where you must be able to explain what protects it.
- A brochure website usually doesn't need one as a priority. A site that presents your business without processing data should be kept up to date first. A WAF can still make sense if it runs on a CMS and plugins that automated attacks often target, if it is already being targeted, or if downtime would be costly.
- If everything is hosted by a vendor, most of this protection is theirs. If your applications are online services operated by their vendor, the vendor handles much of the application security. You still need to verify the protections provided, configure the service correctly and secure your own access.
What a WAF doesn't do
Let's be clear from the start: a WAF is a targeted protection, not a security perimeter.
- It doesn't fix the application. It filters attempts to exploit a flaw. The flaw remains. A WAF used as a permanent bandage is a fix that keeps getting postponed.
- It doesn't protect what doesn't go through it. Direct administrator access, an exposed database or a compromised workstation are invisible to it.
- It doesn't replace updates. The vast majority of compromised applications are breached through a component that wasn't updated.
- It doesn't read its own alerts. Like any security device, it logs. Someone still has to look.
The question to ask before buying one
Before the product, the inventory. Many businesses discover at this stage that they expose an application nobody looks after anymore — an old extranet, an internal tool opened up during the pandemic, a form connected to a database.
The right first question isn't “which WAF”, it's “what do we expose publicly, and who is responsible for it”. The answer often makes the product choice obvious, and sometimes closes the topic by taking offline an application that no longer needed to be there.
You expose an application and don't know what protects it?
30 minutes to inventory what you expose publicly and what protects it today — even if the conclusion is that you don't need anything more.