What a web application firewall does and when a small business needs one

The short answer

A web application firewall sits between visitors and your site and inspects each request before it arrives, blocking those that match known attack patterns: injection attempts, malicious payloads, requests from known bad sources, scanners and floods. It reduces the noise that reaches your application, and when a vulnerability is announced in a component you use it can block the exploit pattern while you update, which is called virtual patching. What it cannot do is fix a flaw in how your application works. It does not see a logic mistake, an access control error or a business process that can be abused, and a determined attacker can often vary a payload to slip past pattern rules and reach a flaw that exists. For a static site with no server code there is little for a firewall to protect, and the managed rules included with the network layer in front of the site are enough. For an application with logins, data and administrative interfaces, a configured firewall is a worthwhile layer. In every case it is a layer, not a substitute for building the application securely.

What it does and does not do

A firewall does	A firewall does not
Block requests matching known injection and scripting patterns	Fix the flaw that would have made the injection work
Drop traffic from known bad sources and scanners	Stop an attacker using a clean source
Rate-limit and challenge floods and bots	Distinguish a clever bot from a person every time
Virtually patch a known vulnerability while you update	Replace the update
Log attack attempts, which is useful information	See logic flaws, access control errors or misuse of features
Enforce geographic or method rules	Protect against a stolen credential used normally

Deciding what you need

Getting value from one

Turn on the managed rule sets and tune them against genuine traffic so real users are never blocked. Add rate rules for the endpoints that matter. Turn on bot management where the platform offers it. Watch the logs for what is being attempted, because they show what attackers think is worth trying. And keep the update routine, because virtual patching is a bridge, not a destination.

What this means for you

A web application firewall filters known attack patterns before they reach your site and buys time against new vulnerabilities; it does not fix flaws in the application. A static site behind a network layer already has the part that matters. An application with logins and data benefits from a configured, watched firewall as one layer over secure code. Buy it for what it does, and never mistake a busy dashboard for a secure application.