What Is a WAF and How Does It Work? A Plain-English Guide

#webdev #security #tutorial #selfhosted

What Is a WAF and How Does It Work? A Plain-English Guide

If you run a website, you've probably been told to "put a WAF in front of it." Here's what that actually means — no jargon.

What "WAF" stands for

A Web Application Firewall protects your app at layer 7 (the application layer) — the part that speaks HTTP. Unlike a network firewall that only cares about IPs and ports, a WAF reads the content of requests and decides whether they're safe.

What problem it solves

Most web attacks arrive as ordinary-looking HTTP requests that carry malicious payloads: a login field stuffed with SQL, a URL containing a script tag, a flood of requests from a botnet. A WAF inspects those requests before they reach your application code and blocks the bad ones.

How it works

It sits in front of your app as a reverse proxy. Every request hits the WAF first.
It inspects the request — headers, URL, body, and cookies.
It decides allow / block / challenge based on its detection logic.
Clean traffic passes through to your app; everything else is stopped.

Two ways WAFs detect attacks

Signature-based: matches known attack patterns (like an antivirus). Needs constant updating, and novel attacks slip through.
Semantic analysis: understands what a request is trying to do (for example, "this is a SQL command"), so it catches variants without a signature. SafeLine uses this approach, which keeps false positives low.

Where it sits

A self-hosted WAF like SafeLine runs on your own server as a reverse proxy. You install it with one command:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

Then open https://<your-server-ip>:9443, point it at your app, and it filters traffic. No third party in the path, no DNS change.

WAF vs firewall vs IPS

Network firewall: controls who can connect (IPs and ports).
IPS: blocks known network intrusions.
WAF: understands HTTP and blocks application-layer attacks. They're complementary, not interchangeable.