What is a Web Application Firewall?
A Web Application Firewall (WAF) sits in front of web applications to filter out malicious traffic at the application layer (Layer 7 of the OSI model, including HTTPS and HTTP traffic). To learn more see here.
Note: Turning off the WAF will disable all packages including OWASP, CloudFlare Rules, and any custom rules you’ve set.
How does a Web Application Firewall protect my website?
WAFs use rule sets to block common attacks like cross-site scripting (XSS) and SQL injections. These rule sets can be customized to individual needs, and because new rules can be added at any time, WAFs can be kept up to date with evolving trends in attacks.
Because CloudFlare's network handles significant attack traffic, we identify new attack styles and add new WAF rules protecting all WAF customers against these potential vulnerabilities.