What is a web application firewall (WAF)?

A web application firewall (WAF) is a filter that sits between the internet and a website or API. It reads each HTTP request and stops the ones that look like attacks, such as SQL injection or cross-site scripting, before they reach the server.

What does a WAF do?

Visitors connect to the WAF instead of directly to your server. The WAF checks each request against rules for known attack patterns, passes the normal ones on, and blocks or records the rest. Your application does not change.

Many WAFs also limit how fast one address may send requests, which slows password guessing and scraping, and keep a log of what they blocked.

How is a WAF different from a network firewall?

A network firewall decides by address and port: it can allow web traffic or refuse it, but it does not read what the request asks for. A WAF reads the request itself, including the path, the parameters and the body. A SQL injection attempt arrives over the same port as a normal visit, so only something reading the request can tell them apart. The two do different jobs, and a site can use both.

Which attacks does a WAF stop?

• SQL injection: database commands hidden in a form field or URL.
• Cross-site scripting (XSS): script planted in a page so that it runs in other visitors' browsers.
• Path traversal: requests that try to read files outside the website's own folder.
• Command injection: operating-system commands passed through an application.
• Abuse: floods of requests, password guessing and unwanted bots, usually with rate limits and bot rules.

The OWASP Top 10, a public list of the most serious web application risks, is a common way to describe this ground.

What does a WAF not do?

A WAF reduces risk; it does not remove it. It does not fix the bug behind an attack, so you still need to patch and update your software. It cannot judge every business-logic flaw, such as one customer being able to open another's invoice. And strict rules can block legitimate requests, which is why careful rollout matters.

What are detect mode and block mode?

In detect mode the WAF records what it would have blocked but lets everything through. In block mode it stops those requests. Starting in detect mode lets you find and fix false alarms before real visitors are affected.

Who needs a WAF?

Anyone running a website or API that takes input from the internet, such as a login page, a checkout or a contact form, is exposed to these attacks. A WAF is especially useful when you have no security team, or when you cannot change an application quickly.

How does Tryam do this?

Tryam is a managed WAF, so we run the firewall and you do not install anything. You add your domain, publish one DNS TXT record to prove you own it, and point its A record at Tryam. New domains start in detect mode, and HTTPS certificates are issued and renewed automatically. See the FAQ and the plans.