WAF Web Application Firewall Guide: Rules Configuration and Attack Prevention

WAF is an important defense layer in website security. Unlike traditional firewalls, WAF analyzes HTTP/HTTPS traffic and blocks SQL injection, XSS, and other application-layer attacks.

1. How WAF Works

User Request → WAF (rule check) → Legitimate → Origin Server
                    ↓
               Block malicious

Detection methods: Rule-based (high accuracy, can't detect unknown), Anomaly-based (finds novel attacks, high false positives), Behavior-based (comprehensive, complex)

2. Popular WAF Solutions

2.1 Cloud WAF (Recommended)

Provider Starting Price Features
Cloudflare WAF $20/month (Pro) Easy, global nodes
AWS WAF $5/month + rules CloudFront integration

2.2 Self-Hosted WAF

3. Common Attack Prevention

3.1 SQL Injection

Most common web attack. Attackers submit malicious SQL in input fields.

WAF rule: Detect SQL keywords (select, union, insert, delete, drop)

3.2 XSS

Attackers inject malicious scripts into web pages.

WAF rule: Detect script tags and event handlers
App-level: Use htmlspecialchars(), CSP headers

3.3 Path Traversal

Attackers try to access unauthorized files (../../etc/passwd).

WAF rule: Block ../ patterns

3.4 CC Attack (Rate Limiting)

Simulated high-frequency access from normal users.

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=30r/m;

4. WAF Rule Best Practices

4.1 Rule Priority

  1. IP whitelist (highest)
  2. IP blacklist
  3. Geo-restrictions
  4. Rate limiting
  5. Attack detection rules
  6. Custom rules

5. Architecture Options

Option 1: CDN + WAF (Recommended)

User → CDN (Cloudflare) → WAF → Origin Server

Pros: DDoS + app-layer protection, hide origin IP

Option 2: Standalone WAF
Full control, compliance-friendly

Option 3: Web Server Plugin
Free but impacts performance

6. Configuration Checklist

  • SQL injection detection enabled
  • XSS detection enabled
  • Rate limiting configured
  • IP whitelist for admin
  • Geo-restrictions (if needed)
  • Logging enabled
  • Alert notifications set up

7. Summary

WAF is essential but not a silver bullet. Best security: WAF + secure code + server hardening. For personal sites, Cloudflare CDN + WAF is simplest. For enterprises, use standalone WAF for finer control.