In this article · 6 sections
A web application firewall (WAF) sits between visitors and your website and filters requests. Normal visitors pass through; requests that look like attacks (SQL injection attempts, bad bots, login floods) are blocked. For small business sites, a WAF is one of the most effective protections you can add quickly.
What a WAF can block
- SQL injection and XSS attempts in URLs and forms. See PHP security basics
- Brute force login attacks. See brute force attacks
- Bad bots scraping content or spamming forms
- Known exploit patterns for popular CMSs and plugins
- Traffic from specific countries or IP ranges if you choose
- Some DDoS traffic. See DDoS protection
What it can't do
- Fix an outdated plugin with a serious hole
- Protect stolen admin passwords used normally
- Replace backups or secure coding
Think of it as a strong gate, not a replacement for locked doors.
Types of WAF
| Type | How it works | Examples | Good for |
|---|---|---|---|
| Cloud / DNS-based | Traffic goes through the provider's network | Cloudflare, Sucuri | Most small sites; also adds CDN speed |
| Plugin / application | Runs inside your CMS | WordPress security plugins | WordPress sites on shared hosting |
| Server-level | Rules on the web server (e.g. ModSecurity) | Many hosts enable it | Managed hosting, VPS |
Getting started with Cloudflare
- Add your domain to Cloudflare and change nameservers
- Enable the managed rules / free WAF options available on your plan
- Turn on Bot Fight Mode
- Add a rate-limiting rule for your login page
- Use SSL mode Full (strict) with a valid certificate on your server
See Cloudflare free plan guide.
Watch for false positives
Occasionally a WAF blocks a real user or your own admin action (e.g. saving a page with code in it). Check the firewall events log and add precise exceptions rather than turning protection off.
FAQs
Does a WAF slow my website?
Cloud WAFs with a CDN often make sites faster because static files are cached closer to visitors.
Is the free Cloudflare plan enough?
For most small business sites it's a big improvement. Paid plans add more managed rules and controls.
Was this article helpful?
Your answer helps us improve our guides