A WAF sits in front of your application, inspects every incoming request, and blocks the ones carrying an attack before they reach your servers.
The short answer
A web application firewall filters HTTP traffic at the application layer. It blocks SQL injection, cross-site scripting, bot traffic and the rest of the OWASP Top 10, along with volumetric attacks. A network firewall decides which ports are open; a WAF reads what is actually inside the request.
It is a control, not a fix. A WAF buys you time on a vulnerability you have not patched yet, and stops the automated traffic that makes up most attacks. It does not repair the underlying flaw.
On this page
Where a WAF sits
Negative and positive security models
This is the difference that decides how much manual work a WAF creates.
| Negative model | Positive model | |
|---|---|---|
| Rule | Block anything matching a known attack pattern | Allow only what the application legitimately expects |
| Catches | Known attacks with a signature | Anything outside normal behaviour, including novel attacks |
| Effort | Rules maintained as attacks evolve | Requires learning the application’s real behaviour first |
| False positives | Higher on unusual but valid traffic | Lower once the profile is accurate |
What it blocks
Injection and scripting
SQL injection, cross-site scripting, command injection and the rest of the OWASP Top 10.
Automated traffic
Credential stuffing, scraping, vulnerability scanners and volumetric floods.
Abuse of your own logic
Forced browsing, parameter tampering, cookie manipulation and unauthorised endpoints.
How Osto runs its WAF
Osto’s reverse-proxy WAF learns each application’s behaviour and generates a positive security policy automatically, so protection stands up without hand-written rules and with fewer false positives. It discovers applications and APIs and applies protection to them, enforces URL, parameter and method validation, checks cookie security and file uploads, and keeps recommending policy changes as the application evolves. Because it runs in the same platform as CSPM, endpoint and the SIEM, a blocked request can be correlated with what else that source has been doing.
Free security assessment
A WAF that configures itself
Osto learns each application and generates a positive security policy automatically, so protection stands up without hand-written rules.
Get a free security assessment Book a platform walkthroughAuto app and API discovery · Low false positives · One platform, everything
Frequently asked questions
What does WAF stand for?
Web application firewall. It inspects HTTP traffic at the application layer and blocks requests carrying attacks before they reach the application.
How is a WAF different from a network firewall?
A network firewall controls which ports and addresses can connect. A WAF reads the content of the request itself, which is the only way to see that a legitimate request to port 443 contains a SQL injection payload.
Does a WAF replace fixing the vulnerability?
No. It reduces exposure while a fix is developed and tested, which is genuinely valuable, but the flaw is still there. Treat WAF blocking as buying time rather than closing the issue.