WAF Web Application Firewall Guide: Rules Configuration and Attack Prevention

WAF Web Application Firewall Guide: Rules Configuration and Attack Prevention

WAF is an important defense layer in website security. Unlike traditional firewalls, WAF analyzes HTTP/HTTPS traffic and blocks SQL injection, XSS, and other application-layer attacks.

1. How WAF Works

User Request → WAF (rule check) → Legitimate → Origin Server
                    ↓
               Block malicious

Detection methods: Rule-based (high accuracy, can't detect unknown), Anomaly-based (finds novel attacks, high false positives), Behavior-based (comprehensive, complex)

2. Popular WAF Solutions

2.1 Cloud WAF (Recommended)

2.2 Self-Hosted WAF

• ModSecurity: Open source, Nginx/Apache
• Naxsi: Nginx WAF module
• OpenResty + Lua: Custom WAF

3. Common Attack Prevention

3.1 SQL Injection

Most common web attack. Attackers submit malicious SQL in input fields.

WAF rule: Detect SQL keywords (select, union, insert, delete, drop)

3.2 XSS

Attackers inject malicious scripts into web pages.

WAF rule: Detect script tags and event handlers
App-level: Use htmlspecialchars(), CSP headers

3.3 Path Traversal

Attackers try to access unauthorized files (../../etc/passwd).

WAF rule: Block ../ patterns

3.4 CC Attack (Rate Limiting)

Simulated high-frequency access from normal users.

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=30r/m;

4. WAF Rule Best Practices

4.1 Rule Priority

1. IP whitelist (highest)
2. IP blacklist
3. Geo-restrictions
4. Rate limiting
5. Attack detection rules
6. Custom rules

5. Architecture Options

Option 1: CDN + WAF (Recommended)

User → CDN (Cloudflare) → WAF → Origin Server

Pros: DDoS + app-layer protection, hide origin IP

Option 2: Standalone WAF
Full control, compliance-friendly

Option 3: Web Server Plugin
Free but impacts performance

6. Configuration Checklist

• SQL injection detection enabled
• XSS detection enabled
• Rate limiting configured
• IP whitelist for admin
• Geo-restrictions (if needed)
• Logging enabled
• Alert notifications set up

7. A Real Attack Interception Postmortem

A concrete case best illustrates WAF's real value. Suppose you run a blog with user comments, and one day an attacker submits a batch of malicious scripts through the comment form:

POST /comment HTTP/1.1
Content-Type: application/x-www-form-urlencoded

comment=<script>document.cookie%3D'x'%3B...%3C/script%3E

Without a WAF, this comment is stored directly, and every browser that later loads the page executes the script, stealing login cookies and potentially forging an admin session. With ModSecurity or a cloud WAF configured, the request is blocked before it reaches the application:

WAF log output:
[rule 1002] XSS detected
IP: 203.0.113.88  →  Blocked (403)

The point of the postmortem is not that the block succeeded, but the two follow-up steps. First, add payload variants to the rules — for example, the hex-encoded form of <script> (%3Cscript%3E) should also be detected. Second, check whether the application itself escapes output — if the code already escapes comment content with htmlspecialchars(), even a rule bypass cannot execute. A WAF and secure code complement each other; relying on either layer alone is not enough.

Keep a steady maintenance cadence for rules: review the top 10 blocked requests weekly to confirm no legitimate users are being hit, and update the rule set monthly against fresh threat intelligence. Security is a continuous arms race, not a one-time configuration.

Reference: OWASP Top 10 https://owasp.org/www-project-top-ten/, Cloudflare WAF documentation https://developers.cloudflare.com/waf/

8. Summary

WAF is essential but not a silver bullet. Best security: WAF + secure code + server hardening. For personal sites, Cloudflare CDN + WAF is simplest. For enterprises, use standalone WAF for finer control.