Web application firewall

Block requests matching signatures for common injection and traversal patterns, which stops a large share of automated, untargeted traffic.

Virtual patching: blocking the specific request shape that exploits a newly disclosed flaw, which buys the days between disclosure and deployment of a real fix.

Rate limiting and bot management, refusing clients that behave automatically.

Absorbing volumetric traffic at the edge, when it sits in front of the origin as part of a CDN.

Providing a log of what was attempted, which is frequently the most useful output and the least used.

Enforcing protocol-level hygiene: refusing malformed requests, oversized headers and inconsistent length declarations, which is a small but genuine class of problem removed before the application sees it.

Understand the application's authorisation rules. A request that is perfectly well-formed and simply asks for someone else's data looks entirely legitimate.

Catch attacks in encrypted or encoded payloads it cannot parse, or in a request shape its rules do not anticipate.

Stop an attacker who can reach the origin directly, which is why an exposed origin address undoes the whole layer.

Fix the underlying flaw. The vulnerability remains, and it remains exploitable by any request the rules do not match.

False positives block legitimate traffic. A rule matching a pattern in ordinary content — a forum post about SQL, a filename with unusual characters — refuses a real request, and the visitor sees an error they cannot explain.

False negatives let an attack through, which is the failure mode that matters and the one nobody observes.

Tuning trades one against the other, and the default rule sets are usually deployed in monitoring mode first for exactly this reason.

A firewall blocking automated checkers is also worth knowing about when interpreting an audit: a 403 from a filtered request says nothing about the page behind it.

Response headers frequently name the vendor, or a CDN that includes one.

A distinctive block page, or a 403 with no body, returned for requests containing pattern-like strings.

Inconsistent behaviour between a browser and a command-line client for the same URL.

A rate-limited response after a small number of rapid requests.

Whether one is worth deploying is a judgement about exposure and operational capacity, not a defect if absent.

Check its behaviour against your own automation too. A monitoring script or a sitemap generator refused by the firewall is a support ticket nobody connects to the deployment that caused it.