Defence

WAF

Web application firewall

A filter in front of a website that blocks malicious requests such as SQL injection attempts.

WAFs inspect web traffic for known attack patterns and can block exploitation of a new flaw before a patch is applied, which is why vendors often ship emergency WAF rules. Attackers look for encodings the rules miss, so a WAF supplements patching rather than replacing it.