security

Web Application Firewall (WAF)

A web application firewall (WAF) is a security layer that filters, monitors, and blocks HTTP traffic between the internet and your WordPress site before malicious requests reach your server.

This glossary entry is for WordPress site owners—business owners, freelancers, and store operators—who want to understand what a WAF does before choosing a security plugin or hosting plan.

A web application firewall (WAF) is a security layer that filters, monitors, and blocks HTTP traffic between the internet and your WordPress site before malicious requests reach your server.

Answer Capsule

A web application firewall (WAF) is a security filter that sits between your website and incoming traffic. It inspects each request against a ruleset and blocks threats—SQL injection, cross-site scripting (XSS), brute-force login attempts—before they touch your WordPress files or database.

What Does a WAF Do in WordPress?

A WAF examines every request hitting your site and compares it against known attack signatures. If a request matches a threat pattern—for example, a URL parameter containing SELECT * FROM—the WAF drops it before WordPress even loads.

We see this consistently on client sites: a WAF blocks hundreds of automated probe requests per day that a standard network firewall would pass right through, because those probes look like normal HTTP traffic at the network level.

Network Firewalls vs. Web Application Firewalls

A traditional network firewall operates at the IP and port level—it blocks traffic from suspicious IP addresses or ports. A WAF operates at the application layer (Layer 7 of the OSI model), which means it can read the content of requests and catch attacks that arrive on port 80 or 443 just like legitimate visitors do.

OWASP’s WAF definition describes this distinction clearly: WAFs protect servers where proxies protect clients.

Where WAFs Appear in WordPress

You encounter a WAF in three places:

  1. Hosting-level WAF — Managed WordPress hosts like Kinsta and WP Engine include a WAF in their infrastructure. Zero configuration required; rules update automatically.
  2. DNS/CDN-level WAF — Services like Cloudflare route your traffic through their network, applying WAF rules before a request reaches your server. Cloudflare’s free tier includes basic WAF rules as of 2024.
  3. Plugin-level WAF — Security plugins such as Sucuri and MalCare install a WAF either as a DNS proxy or on the server itself. In our testing, plugin-level WAFs that operate as a DNS proxy (Sucuri’s approach) perform closer to hosting-level WAFs than purely on-server solutions, because the block happens before the request loads PHP.

One Configuration Detail Most Guides Skip

Plugin-level WAFs that filter after WordPress loads PHP still execute your WordPress bootstrap for every request—including the malicious ones. That means a high-volume attack can still spike your CPU even if all requests are ultimately blocked. A DNS-level WAF (Cloudflare, Sucuri’s proxy mode) stops the request before it touches your server at all. For shared hosting sites especially, this distinction matters.

Additional Reading

Last verified: April 2026

Back to Glossary