Web Application Firewall (WAF)#
While the UFW firewall protects your server at the network level, the Web Application Firewall (WAF) protects your websites at the application level. The WAF inspects incoming HTTP requests and blocks those that contain malicious payloads — protecting against SQL injection, cross-site scripting (XSS), file inclusion attacks, and other OWASP Top 10 threats.
How WAF Works#
The WAF sits between your visitors and your websites, analyzing every incoming request in real-time. When a request matches a known attack pattern, the WAF blocks it before it reaches your application. This happens transparently — legitimate visitors are never affected.
Think of it as a security guard at the door of your website: it lets normal visitors through while stopping anyone carrying harmful tools.
Enabling WAF#
Navigate to Security from the sidebar and locate the WAF section. Toggle the WAF switch to enable protection. You can enable WAF globally (for all websites) or on a per-website basis.
What WAF Protects Against#
SQL Injection (SQLi)
Blocks attempts to inject malicious SQL code through URL parameters, form fields, and cookies. SQL injection is one of the most common and dangerous web attacks — it can expose your entire database, including user passwords and personal information.
Cross-Site Scripting (XSS)
Filters requests containing JavaScript injection attempts. XSS attacks can steal session cookies, redirect visitors to phishing sites, or deface your website.
Path Traversal / Local File Inclusion (LFI)
Prevents attackers from accessing files outside your web root using ../ paths. These attacks target sensitive files like /etc/passwd or configuration files containing database credentials.
Remote File Inclusion (RFI)
Blocks attempts to include external files that could execute malicious code on your server.
Rate Limiting
Limits the number of requests from a single IP address within a time window. This prevents brute-force login attacks, credential stuffing, and denial-of-service attempts.
Request Size Limiting
Blocks oversized HTTP requests that could exhaust server resources or exploit buffer overflow vulnerabilities.
WAF Logs#
Every blocked request is logged with detailed information:
- Timestamp — When the attack was detected
- Source IP — The attacker’s IP address
- Requested URL — The targeted endpoint
- Attack Type — The category of attack (SQLi, XSS, etc.)
- Rule Matched — Which WAF rule triggered the block
- Action Taken — Block, log-only, or challenge
Review WAF logs periodically to understand the attack patterns targeting your websites and fine-tune your rules accordingly.
IP Whitelist and Blacklist#
Whitelist: Add trusted IP addresses that should bypass WAF checks entirely. Common use cases:
- Your office or home IP address
- Payment gateway callback IPs (Stripe, PayPal)
- Third-party API services that send requests to your site
- Internal monitoring services
Blacklist: Permanently block specific IP addresses. Useful for:
- Known attackers who repeatedly target your site
- IP ranges associated with spam or abuse
- Blocking specific countries or regions (if needed)
URL Exceptions#
Some legitimate requests may trigger WAF rules, especially API endpoints that accept complex data. You can whitelist specific URL paths to exclude them from WAF scanning:
- WordPress admin AJAX endpoint:
/wp-admin/admin-ajax.php - WooCommerce webhooks:
/wc-api/ - Custom API endpoints with complex payloads
???? Tip: If you notice a legitimate feature on your site not working after enabling WAF, check the WAF logs for blocked requests on that URL. Add a URL exception if the block is a false positive.