What is a WAF and what difference does it have with a normal firewall?
Published on 2026-10-20 by frfrand
Qué es un firewall de aplicaciones web, cómo filtra peticiones HTTP, falsos positivos y por qué no reemplaza corregir vulnerabilidades.
A WAF is a firewall specialized in web application traffic. Its acronym stands for Web Application Firewall. Unlike a basic network filter that works with addresses, ports, and protocols, a WAF can examine characteristics of HTTP requests and apply rules related to web attacks.
It is not an antivirus for your page nor a guarantee that any vulnerability is covered.
The access control example
Imagine a building with a guarded entrance door. The general control checks through which door a person arrives and if that door is open. An additional filter can review certain characteristics of what attempts to be introduced into the building.
The comparison helps to understand the difference between a network firewall and one oriented to applications. Both can be combined.
What can a WAF recognize?
Depending on the product and its configuration, it can identify patterns associated with certain injection attempts, exploitation of known flaws, automated traffic, or anomalous requests.
Many systems use managed rules, scores, and signals about the request. That does not mean they can perfectly understand the user's intention nor always distinguish a malicious request from a legitimate one.
An aggressively configured WAF can block correct forms or API requests that use uncommon parameters.
Where is it installed?
It can run on a protection service in front of the origin, on a proxy, or at other entry points. Position matters: if someone can still access the server directly, bypassing the protective layer, some traffic will not pass through it.
You also need to define how to correctly obtain the visitor's IP when there are intermediate proxies. Blindly trusting any header sent by the client can lead to wrong decisions.
WAF vs firewall vs rate limiting
The network firewall controls connections based on network rules. The WAF analyzes signals related to web application requests. Rate limiting restricts the request rate under certain conditions.
They are not the same, but they can work together. An authentication API may need all three, plus input validation and access controls.
Does it protect against SQL injection or XSS?
It can block certain known patterns, but it does not replace writing parameterized queries or properly escaping data in the output context.
If an application contains an authorization flaw that delivers one user's data to another, a WAF may not have enough context to recognize it. Real security still requires fixing software defects.
What are false positives?
A rule detects something suspicious and blocks traffic that was legitimate. This can happen when a user enters code on an educational platform or sends a parameter that looks like an injection, even if it is allowed content.
That is why rules must be observed, adjusted, and tested before activating them with overly strict policies. Protection that prevents using the product also creates problems.
How to know if it works?
Review blocking events, affected routes, HTTP codes, and trends. Test in an authorized environment the behaviors it should block and the legitimate requests it should allow.
Do not base security on a single "threats stopped" counter: some products count harmless automated traffic within their metrics.
And ArduMaker?
If you run a website on a VPS managed with ArduMaker, you can place a WAF service compatible with your architecture in front of it. You will need to correctly configure proxy, HTTPS, origin access, and backend rules.
Final idea: a WAF can reduce risks at the entry of a web application, but it does not replace the server firewall, permission control, or security fixes.
Sources: OWASP Web Application Firewall · OWASP Core Rule Set.