A web application firewall is a security appliance or service that sits between the internet and your web application, inspecting HTTP and HTTPS traffic at the application layer to block attacks targeting your application logic, database, and APIs. Unlike a network firewall that controls access based on IP addresses and ports, a WAF understands web application protocols and can distinguish between a legitimate user submitting a form and an attacker injecting SQL commands into the same form field.

A network firewall controls which ports and protocols can communicate between network segments, blocking unauthorized connections at the network layer. A WAF operates at the application layer (Layer 7) and inspects the actual content of web requests, blocking attacks that come through allowed ports over allowed protocols. Both are necessary: the network firewall limits network access and the WAF protects the web application itself from exploitation through legitimate HTTP and HTTPS connections that the network firewall cannot distinguish from normal traffic.

The OWASP Top 10 is a regularly updated list published by the Open Web Application Security Project identifying the ten most critical web application security risks. The current list includes injection attacks (SQL, OS command, LDAP), broken access control, cryptographic failures, insecure design, security misconfiguration, vulnerable and outdated components, identification and authentication failures, software and data integrity failures, security logging failures, and server-side request forgery. A WAF provides defense-in-depth against these categories without requiring code changes to the application itself.

A CDN improves performance and provides some basic DDoS absorption through traffic distribution, but it is not a substitute for a dedicated WAF. CDN-based WAF offerings vary significantly in their rule quality, tuning options, and API protection capabilities. Organizations subject to PCI DSS, HIPAA, or SOC 2 typically require a dedicated WAF with auditable rule sets, logging, and compliance reporting, which CDN-bundled security features do not always provide. A dedicated WAF appliance or service gives you granular control over application security policies.

Yes. PCI DSS Requirement 6.4 requires that all public-facing web applications are protected against known attacks either by installing a WAF in front of the application or by performing a web application security assessment and remediating all identified vulnerabilities. In practice, a WAF is the preferred option because it provides continuous protection as new vulnerabilities emerge, whereas a point-in-time assessment requires repeated retesting. Barracuda WAF and Fortinet FortiWeb both include PCI DSS compliance reporting features.