Buyer's guide
Web application firewalls explained
A web application firewall (WAF) sits in front of a website or API and inspects every HTTP request. It blocks attacks such as SQL injection, cross-site scripting, credential stuffing and malicious bots before they reach your server. Most teams now use a cloud WAF from a provider such as Cloudflare, AWS, Akamai or Imperva, and the hard part is tuning and running it.
- ISO 27001 compliant
- SOC 2 Type 2 compliant
- Preferred Cloudflare Partner
- 24/7 follow-the-sun support
What a WAF blocks
- Injection attacks: SQL injection, command injection and similar payloads in forms, URLs and headers.
- Cross-site scripting attempts.
- Known exploits for popular software, through managed rules updated by the provider.
- Credential stuffing and abusive bots, through rate limits and bot scoring.
- Layer 7 DDoS floods, when the WAF runs on a large edge network.
Types of web application firewall
- Cloud or edge WAF: runs on the provider's network in front of your site. Quick to deploy and absorbs large attacks. Examples: Cloudflare, AWS WAF, Akamai, Imperva, Fastly.
- Appliance or virtual WAF: runs in your data centre or cloud account. More control, more upkeep. Examples: F5, Fortinet FortiWeb.
- Host-based WAF: a module on the web server, such as ModSecurity. Cheap but adds load and needs expert rules.
WAF types compared
| Cloud / edge WAF | Appliance or virtual WAF | Host-based WAF | |
|---|---|---|---|
| Where it runs | Provider's global network | Your data centre or cloud account | On the web server |
| Absorbs DDoS | Yes | Limited by your bandwidth | No |
| Set-up | DNS change | Deploy and size hardware or VMs | Install a module |
| Rule updates | Managed by provider | Vendor feeds, you apply | You maintain |
| Best for | Most websites and APIs | Strict on-premises requirements | Small, single-server sites |
How to choose a WAF
- Coverage: managed rules for the software you run, API protection and bot management.
- False positives: how easily you can see and fix blocks that hit real customers.
- Operations: who writes rules, reviews events and responds to an attack at 3am.
- Performance: whether the same network also caches and speeds up the site.
- Cost: per-request pricing can rise sharply during an attack. Check what is included.
A WAF still needs someone to run it
Out-of-the-box rules stop common attacks, but every site needs tuning: allow lists for partners, rate limits for login and checkout, and quick changes during an incident. That is why many teams buy a managed WAF.
Vigilbase Shield is a managed Cloudflare WAF. Vigilbase is a Preferred Cloudflare Partner and configures the rules, watches the traffic and changes protection when attacks happen, with follow-the-sun support around the clock.
How Vigilbase helps
Vigilbase runs security operations and website protection for businesses that would rather not build a security team.
Vigilbase Shield
Managed Cloudflare WAF, DDoS and bot protection, configured and watched by our team.
Learn moreVigilbase OS
AI investigates every alert and brings you only verified threats, with the fix ready to approve.
Learn moreManaged SOC
A security team watching your environment around the clock, without hiring one.
Learn moreFrequently asked questions
What is the difference between a firewall and a web application firewall?
A network firewall filters traffic by IP address and port. A web application firewall reads the content of HTTP requests and blocks attacks hidden in them, which a network firewall cannot see.
Do I need a WAF if my site is on a managed host?
Usually yes. Hosts patch the server, but your application, plugins and login pages are still exposed. A WAF blocks exploit attempts and bots in front of them.
Will a WAF slow down my website?
A cloud WAF on a large edge network adds little delay and often makes the site faster, because the same network caches content close to visitors.
What is a managed WAF?
A WAF that a specialist configures and operates for you, including rule tuning, monitoring and response during attacks. Vigilbase Shield is one.
More free tools and guides
Security handled, around the clock
Vigilbase is ISO 27001 and SOC 2 Type 2 compliant and a Preferred Cloudflare Partner, with follow-the-sun support from teams in Kenya, South Africa, the UAE and Portugal.