WAF

What is WAF (Web Application Firewall)?

## What it is

A WAF operates at the application layer (L7) and analyzes requests to a web application before they reach the server. Unlike a conventional network firewall, which looks at IP addresses and ports, a WAF inspects the content of a request: parameters, headers, cookies, and the body of POST requests.

## How it works

A WAF usually sits in front of a site as a reverse proxy or runs in the cloud via DNS. It compares requests against a set of rules (signatures of known attacks, the OWASP Core Rule Set) and behavioral heuristics such as request frequency, unusual User-Agent strings, and abnormal parameters. A match can result in a block, a CAPTCHA, or logging only.

## Where it is used

In gambling and betting, a WAF protects player accounts, cashier pages, and betting APIs from credential stuffing and odds scrapers. In crypto and fintech, it covers login endpoints, withdrawal endpoints, and exchanger APIs. In dating and nutra, bot protection is more common, including protection against profile scraping and lead fraud through forms.

## What it affects

A misconfigured WAF can block legitimate users, especially those using VPNs, proxies, or non-standard browsers, and can cause false positives during payments and registration. This directly reduces conversion and may look like a technical failure to partners and traffic teams.

## Common mistakes

Teams switch a WAF to "block only" mode without an observation period; they fail to exclude payment provider webhooks and callback URLs, which leads to lost payment confirmations; and they rely on the WAF as the only defense, forgetting about parameterized queries and backend authentication.