Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is a Web Application Firewall (WAF)?

Definition

A web application firewall (WAF) is a filter that sits in front of a website and inspects web requests before they reach it. OWASP describes it as "an application firewall for HTTP applications" that "applies a set of rules to an HTTP conversation," generally covering attacks such as cross-site scripting and SQL injection.

How It Works

A WAF can run in three common places:

  • At the edge, as a cloud service or CDN (for example, Cloudflare or Sucuri), so bad traffic is dropped before it reaches the server.
  • On the server, as a module such as ModSecurity with the OWASP Core Rule Set.
  • Inside WordPress, as a security plugin. This is easy to install but runs in PHP, so heavy attacks still use server resources.

Each request is compared with rules. Some match known attack patterns (an SQL fragment in a search box, a script tag in a comment). Some enforce behavior, like rate limiting login attempts or blocking xmlrpc.php. Some are virtual patches: targeted rules that block exploitation of a specific known plugin flaw until the plugin is updated.

A WAF reduces risk; it does not remove it. Rules can be bypassed, false positives can block real customers, and a WAF does nothing about a stolen admin password used normally. Configuration matters as much as the product. A WAF also needs the same care as any other server: least-privilege permissions, patching, and monitoring of its own logs.

Real-World Example

The 2019 Capital One breach turned on a misconfigured WAF. A federal indictment said the object of Paige Thompson's scheme was "to exploit the fact that certain customers of the Cloud Computing Company had misconfigured web application firewalls" and use that misconfiguration to obtain credentials with permission to read stored data. The Justice Department said the intrusion affected more than 100 million U.S. customers. In August 2020, the OCC fined Capital One $80 million, citing its failure to establish effective risk assessment before moving IT operations to the public cloud.

Why It Matters for a Small Business

Small business websites are scanned and attacked by bots around the clock, mostly looking for known plugin bugs. An edge WAF blocks much of that noise, buys time between a vulnerability announcement and a plugin update, and keeps login floods from slowing the site. It is one of the few protections that works even when updates are a few days behind. The Capital One case is the reminder: a WAF is configuration, and a badly set one can become the way in.

How to Spot It / How DTS Handles It

Warning signs: no WAF or CDN in front of the site, a security plugin installed but never configured, the origin server's real IP address reachable directly so traffic can skip the WAF, and nobody reviewing what the WAF blocks.

DTS can help with putting a WAF or CDN in front of a WordPress site, turning on rate limiting and virtual patching, restricting the origin server to WAF traffic, and reviewing what gets blocked. See our WordPress maintenance service.

Related Terms

  • Virtual patching: WAF rules that block a known bug until it is fixed.
  • Cross-site scripting (XSS): an attack WAF rules commonly filter.
  • SQL injection (SQLi): another core WAF rule set.
  • Brute force attack: login floods a WAF can rate limit.
  • Origin IP exposure: how attackers skip the WAF.
  • CDN: the edge network many WAFs run on.
  • DDoS attack: traffic floods an edge WAF helps absorb.

Sources

  • OWASP, Web Application Firewall: https://owasp.org/www-community/Web_Application_Firewall
  • U.S. v. Paige A. Thompson, No. 2:19-cr-00159-RSL, Dkt. 102 (W.D. Wash., filed June 17, 2021), hosted by DOJ: https://www.justice.gov/usao-wdwa/page/file/1405446/dl?inline=
  • U.S. Attorney's Office, W.D. Washington, Former Seattle tech worker convicted of wire fraud and computer intrusions (June 17, 2022): https://www.justice.gov/usao-wdwa/pr/former-seattle-tech-worker-convicted-wire-fraud-and-computer-intrusions
  • OCC, OCC Assesses $80 Million Civil Money Penalty Against Capital One (August 6, 2020): https://www.occ.gov/news-issuances/news-releases/2020/nr-occ-2020-101.html

Last updated October 14, 2026.