Application layer firewall that filters malicious web requests before they reach the server.
WAF (Web Application Firewall) reads HTTP request content and blocks attack patterns targeting web applications, such as SQL injection, XSS, or admin path probing.
Unlike conventional network firewalls that only examine addresses and ports, WAF understands content at the application layer. Therefore it supplements rather than replaces network firewalls.
Deployment note: all WAFs have a false positive rate. You should run in logging-only mode for a period to review rules mistakenly blocking real business operations before enabling blocking.
