A Website Firewall (WAF) That Protects Without Getting in the Way
A website firewall sits in front of your site and filters traffic. It stops many attacks before they reach your server. We choose, set up and tune the firewall so it blocks bad traffic and lets real customers through.
What is a website firewall (WAF) and do I need one?
A website firewall, or WAF (web application firewall), checks every request to your site and blocks traffic that looks like an attack, such as SQL injection, bad bots or login floods. Most business websites benefit from one, because it adds a layer of protection while updates and fixes are applied. It works best alongside secure code and regular updates.
Key takeaways
- A WAF filters web traffic; a network firewall filters ports and connections.
- Cloud WAFs block attacks before they use your server's resources.
- Plugin firewalls see more of the app but run on your server.
- Start in log mode, then block, to avoid stopping real customers.
- Lock the origin server so attackers cannot go around the WAF.
- A WAF is one layer; it does not replace updates or secure code.
What is a website firewall (WAF)?
A website firewall, or web application firewall (WAF), is a filter between visitors and your website that inspects each web request and blocks those that match attack patterns or come from bad sources.
| Type of firewall | What it looks at | Example |
|---|---|---|
| Network firewall | IP addresses, ports, protocols | Server firewall that only opens ports 80, 443 and SSH |
| Web application firewall | Web requests: URLs, form data, headers, bots | Cloudflare WAF, ModSecurity, security plugins |
| Device firewall | Traffic on one computer | Windows or macOS firewall on a staff laptop |
You need both a network firewall on the server and a WAF for the website. This page focuses on the WAF, which is part of our website security services.
What attacks does a WAF block?
A WAF blocks common web attacks such as SQL injection attempts, cross-site scripting, known plugin exploits, login floods, bad bots and scrapers. It also helps during traffic floods when combined with DDoS protection.
Known exploit attempts
Requests that target known bugs in popular plugins, themes and frameworks.
Injection attempts
Form or URL inputs that try to run database or script commands.
Login attacks
Many password guesses on wp-admin, admin panels or API login routes.
Bad bots and scrapers
Bots that copy prices and content, fill forms with spam or hunt for weak spots.
Card testing on checkout
Bots trying stolen cards on payment pages, a big issue for WooCommerce stores.
Traffic floods
Sudden waves of requests meant to slow the site, handled with rate limits and DDoS protection.
Cloud WAF vs plugin firewall vs server WAF: which is better?
For most business websites, a cloud WAF is the best first choice, because it blocks attacks before they reach your server. A plugin or server WAF is a good second layer, especially for WordPress.
| Option | Where it runs | Strengths | Limits |
|---|---|---|---|
| Cloud WAF (e.g. Cloudflare, Sucuri, AWS WAF) | In front of your site, at the DNS/CDN level | Stops traffic early, adds CDN speed and DDoS help | Must lock the origin server so attackers cannot skip it |
| Plugin firewall (e.g. WordPress security plugins) | Inside your website code | Knows about users and app logic; easy setup | Uses your server resources; loads after PHP starts |
| Server WAF (e.g. ModSecurity) | On the web server | Protects every site on the server | Needs careful tuning; harder on shared hosting |
Cloud WAF
- Blocks attacks before they use server power
- Works for any platform
- Includes caching and SSL at the edge
Plugin WAF
- Runs inside the site, so load still hits the server
- Only for that platform, such as WordPress
- Can conflict with caching or other plugins
How do we set up a website firewall step by step?
We set up a WAF in stages: plan, connect, watch in log mode, then turn on blocking and tune. This avoids blocking real customers, payment callbacks or your own team.
- 1
Map your site
List login pages, checkout, APIs, payment webhooks, admin areas and countries you serve.
- 2
Connect the WAF
For a cloud WAF, move DNS or point the domain through the WAF. Keep SSL working end to end.
- 3
Turn on managed rules in log mode
Let the WAF record what it would block for a few days without blocking yet.
- 4
Review the logs
Find false positives, such as a contact form or payment callback that looks unusual.
- 5
Switch to block mode
Turn on blocking with exceptions for safe traffic like payment gateways.
- 6
Add custom rules
Rate limit login and OTP pages, protect admin paths, challenge bad bots.
- 7
Lock the origin
Allow web traffic to the server only from the WAF's IP ranges, so attackers cannot skip it.
- 8
Monitor and tune
Review blocked traffic monthly and after site changes.
Will a firewall block my real customers?
A badly tuned WAF can block real users, but careful setup prevents this. Starting in log mode, adding exceptions for payment and app traffic, and using challenges instead of hard blocks keeps customers safe and happy.
Common false positive causes
- Payment gateway or UPI callback URLs blocked as "unknown bots"
- Long product descriptions with code-like text saved from the admin panel
- Country blocking that also blocks your own staff travelling or NRI customers
- Mobile app API traffic without a browser user agent
- Search engine and social preview bots mistaken for bad bots
We keep a short list of allowed services and test key journeys, like enquiry forms, WhatsApp chat buttons, login and checkout, after every rule change.
Firewall rules every business website should have
Every business site should use managed attack rules, rate limits on login and forms, protection for admin areas and a bot policy. These four basics stop most automated attacks.
- Managed rule sets for common attacks turned on
- Rate limit on login, password reset, OTP and contact forms
- Admin paths such as /wp-admin or /admin limited by country, IP or extra login
- Block access to sensitive files such as .env, .git and backup archives
- Challenge known bad bots; allow verified search engine bots
- Block XML-RPC on WordPress if no app needs it
- Alerts when blocked traffic suddenly spikes
For apps and APIs, add rules per route. Our API security and web application security pages explain this in more detail.
What a WAF cannot do
A WAF cannot fix insecure code, weak passwords, old plugins or a hacked admin account. It reduces risk and buys time, but you still need updates, strong logins, backups and monitoring.
- It cannot stop someone who logs in with a stolen but valid password; use two-step login
- It cannot clean malware already inside your site; see malware removal
- It may miss logic bugs, such as a user viewing another user's order
- It cannot protect a server that attackers reach directly by IP if the origin is not locked
- It does not replace backups if something goes wrong
Pair the WAF with security monitoring so you see when something gets through.
WAF setup cost, timeline and how to choose a provider
A WAF setup for a normal business site can usually be done in a few days, including a short log-mode period. Cost depends on the WAF plan you choose, site complexity and whether you want ongoing tuning.
- Number of domains and subdomains
- Platform and hosting setup
- Checkout, APIs and mobile app traffic
- Free or paid WAF plan features
- One-time setup or monthly monitoring and tuning
Questions to ask a provider
- Will you start in log mode before blocking?
- How do you handle payment gateway and app traffic?
- Will you lock the origin server?
- Who reviews blocked traffic, and how often?
- What happens during an attack outside office hours?
You get a clear quote after a free call. Our parent team, Shivah Web Tech, offers 24x7 emergency support for urgent issues. Contact us to start.
Related Pages
Website Security
Harden, update and protect your business website every day.
DDoS Protection
Keep your website online during traffic floods and bot attacks.
Security Monitoring
Alerts for downtime, file changes, logins and blacklists.
Web App Security
Secure code, logins and data in custom web applications.
Frequently Asked Questions
Do small business websites really need a firewall?
Yes. Most attacks are automated and target any site they can find, large or small. A WAF blocks a large share of this background noise, such as login guessing and plugin exploit attempts. Many good WAF options have free or low-cost plans that suit small business sites.
Is Cloudflare a web application firewall?
Cloudflare offers a WAF as part of its service, along with CDN, DNS and DDoS protection. The free plan includes some basic protections, while paid plans add more managed rules and features. It needs correct setup, including SSL mode and origin locking, to protect your site well.
Will a website firewall slow down my site?
A cloud WAF often makes the site faster, because it usually comes with a CDN that caches pages close to visitors. A plugin firewall adds a small amount of work on your server for each request. Good tuning keeps any delay very small.
Can I use a cloud WAF and a security plugin together?
Yes, and it is common for WordPress sites. The cloud WAF blocks most bad traffic early, and the plugin adds login protection and file scanning inside the site. Avoid turning on two plugin firewalls at once, as they can conflict and slow the site.
What is the difference between a WAF and antivirus?
A WAF checks traffic coming to your website and blocks attacks. Antivirus or malware scanners check files for bad code that is already there. They do different jobs. A good setup has both: a WAF in front and scanning plus monitoring behind it.
How do I know if my firewall is working?
Check the WAF dashboard for blocked requests and the reasons. You should see blocked login floods, bad bots and exploit attempts. Also test that your forms, checkout and payment callbacks still work. If nothing is ever blocked, the WAF may not be in the traffic path.
Should I block whole countries with my firewall?
Country blocking can cut a lot of bot traffic if you only sell in a few countries. But it can also block real customers, travelling staff and search tools. A softer option is to show a challenge to traffic from countries you do not serve, and to limit country rules to admin and login pages only.
How much does a website firewall cost in India?
There is no single price. Some cloud WAFs have free plans, and paid plans are billed monthly based on features and traffic. Setup and tuning work is a separate service. You get a clear quote after a free call, based on your site, platform and the protection level you need.
Can attackers bypass a cloud WAF?
They can if your server's real IP address is known and the server accepts traffic from anywhere. To prevent this, allow web traffic only from the WAF provider's IP ranges, avoid leaking the origin IP in DNS records or emails, and change the server IP if it was exposed before.
Talk to our team today
Call or WhatsApp +91 85808 92163. We reply fast, Monday to Friday.