Web Application Firewall

Web Application Firewall: Filters HTTP traffic to protect web applications against common attacks. The term relates to the security of applications, interfacesInterfaceA defined boundary through which systems, components, or users exchange data and commands., or development processesDevelopment ProcessThe organized workflow used to design, implement, test, release, and maintain software.. Relevant measures range from secure designSecure DesignDesigning systems so security requirements and trust boundaries are addressed before implementation. and testing to runtime protection and rapid remediationRemediationThe correction or mitigation of a confirmed security weakness, defect, or misconfiguration..

How it works and where it fits

Web Application Firewall is a preventive, detective, or corrective security control. Its effect depends on where it sits in the architecture, which data and decisions it processes, and how it might be bypassed. A control reduces a defined risk but rarely removes it completely, so it should be combined with additional layers of protection.

Practical security relevance

Before deployment, the objective, ownership, coverage, and expected behavior should be defined. Secure defaults, controlled exceptions, logging, and periodic effectiveness tests matter more than installation alone. Operational metrics should expose both blocked or detected activity and gaps, false alerts, and effects on legitimate business processes.

Related concepts

• Application SecurityApplication SecurityProtects software against vulnerabilities during development, operation, and maintenance.: Protects software against vulnerabilities during development, operation, and maintenance.
• FirewallFirewallControls network traffic based on defined rules and security policies.: Controls network traffic based on defined rules and security policies.
• Cross-Site ScriptingCross-Site ScriptingInjection of executable script code into web application content.: Injection of executable script code into web application content.
• SQL InjectionSQL InjectionManipulates database queries through insufficiently validated inputs.: Manipulates database queries through insufficiently validated inputs.