What is WAF?
A web application firewall inspects HTTP requests and responses at the application layer and blocks those matching rules for attacks such as SQL injection, cross-site scripting and path traversal. It runs in front of the application as a reverse proxy, a server module or a cloud service, and most deployments add IP reputation feeds and rate-based rules alongside signature matching.
Two models run side by side. A negative model matches known-bad patterns, the OWASP Core Rule Set being the widely deployed open example used by ModSecurity and its successor Coraza. A positive model allows only traffic that fits a declared schema for each endpoint. The Core Rule Set exposes paranoia levels from 1 to 4, and raising the level catches more attacks while generating more false positives, which is why most teams run it in detection-only mode and tune before they enforce.
Deployment shapes what a firewall can see. Cloudflare, AWS WAF, Akamai, Imperva and Fastly run at the edge, terminating TLS and scoring requests before the origin hears about them. A module such as ModSecurity inside nginx or Apache sees the same requests, but only once they have arrived. Either way the rules operate on decrypted HTTP, reading the method, path, query string, headers, cookies and body, which is also where the cost of full body inspection appears.
Automated traffic gets caught by rules that have nothing to do with attacks. Managed rule groups include IP reputation feeds, and an address recycled through spam, credential stuffing or an open-proxy list is refused on reputation before any payload is examined. Rate-based rules count requests per address over a window and add offenders to a temporary block. Header anomalies count as well, whether a missing Accept-Language or a user agent that appears on a known-tool list.
A firewall is a different thing from a bot management system, even though vendors sell them together. The firewall answers a per-request question about whether this payload looks hostile. Bot scoring answers a per-client question about whether a human is driving. Blocks usually arrive as a 403 with a vendor-branded page, sometimes carrying a support or trace ID you can quote to the site owner. False positives are common enough that a team hitting a partner's API should ask which rule fired.
Where you meet it
You meet a WAF when a request that works from your laptop returns 403 through a proxy, or when one field in a POST body triggers a block while the rest of the form goes through. The split worth testing is payload against identity. Replay the same request from a clean address, then send a harmless request from the blocked one. Whichever fails tells you which class of rule you tripped.
Common questions
What is the difference between a WAF and a network firewall?
A network firewall filters by address, port and protocol at layers 3 and 4. A WAF reads the decrypted HTTP request, including path, headers, cookies and body, and decides on content. That lets it block a SQL injection attempt arriving on port 443 that a network firewall would pass as ordinary HTTPS traffic.
Why does a WAF block my proxy?
Usually reputation rather than payload. Managed rule sets subscribe to address feeds listing ranges seen in abuse, and much datacenter space carries that history. Rate-based rules add short bans for any address crossing a request threshold. Neither rule type looks at what you sent; both act on where the request came from.
Can a WAF inspect HTTPS traffic?
Yes, wherever it terminates TLS. An edge service decrypts the connection, applies its rules to the plaintext request, then re-encrypts to the origin. A device that only sees encrypted bytes passing by, without terminating the session, cannot apply application-layer rules to them at all.
Related terms
Real 4G/5G mobile and residential IPs
PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.