The best web application firewall depends on where your site runs and who will tune it: an edge service suits most businesses, a cloud provider's own WAF suits apps already on that cloud, and an open source WAF suits teams that self-host. Eleven options follow in no particular order.
A web application firewall sits in front of your site and reads every request before your server does. It's there to stop the attacks a normal network firewall can't see, such as someone stuffing database commands into a login form.
The eleven tools below are listed alphabetically and in no particular order, from free open source engines to services run on huge edge networks. Every description comes from the vendor's own site, read this week. For the basics that sit around a firewall, see my guide to securing and protecting your website.
WAF options side by side
In the free plan column, Yes means the tool's own site names a free plan, a free version, a free tool or an open source edition. Trial only means a time-limited trial. Not stated means the pages I read named neither, even where there's a button inviting you to try it.
| Tool | Type | Good for | Free plan |
|---|---|---|---|
| Akamai App and API Protector | Edge WAF and API protection | Large sites already using edge services | Trial only |
| AWS WAF | Cloud WAF inside AWS | Apps already hosted on AWS | Not stated |
| Barracuda Web Application Firewall | WAF and API security | Mid-market web app and API protection | Trial only |
| BunkerWeb | Open source WAF | Secure by default self-hosting | Yes |
| Cloudflare WAF | Edge WAF with managed rules | Fast rule updates for new vulnerabilities | Not stated |
| CyberServal WAF | Self-hosted WAF (formerly SafeLine) | Self-hosting with a community edition | Yes |
| Fastly Next-Gen WAF | Web app and API security | Protecting apps and APIs anywhere | Not stated |
| Imperva Web Application Firewall | Cloud and on-premises WAF | Choosing between cloud or on-prem deployment | Not stated |
| open-appsec | Machine learning open source WAF | Fewer rule updates and exceptions | Yes |
| OWASP Coraza | Open source WAF engine | Developers embedding a WAF in their stack | Yes |
| Sucuri Website Firewall | Website firewall and security platform | Small business and WordPress websites | Not stated |
Eleven web application firewalls worth a look
Akamai App and API Protector
Best for: Enterprises that want web app and API protection from a major edge and cloud security provider, with free trials listed on the site.
AWS WAF
Best for: Engineering teams already running on Amazon Web Services that want firewall rules managed next to the rest of their cloud setup.
Barracuda Web Application Firewall
Best for: Mid-sized companies that want web application and API security from an established security vendor, with a free trial.
BunkerWeb
Best for: Technical teams that want an open source WAF they can run themselves, set up to be secure by default.
Cloudflare WAF
Best for: Sites of any size that want requests inspected at the edge using managed and custom rules, with fast responses to new vulnerabilities.
CyberServal WAF
Best for: Self-hosters who want an open source WAF with a big install base, now sold under the CyberServal name alongside the SafeLine edition.
Fastly Next-Gen WAF
Best for: Engineering teams that want app and API security that works across clouds, data centres and edge, from a known CDN.
Imperva Web Application Firewall
Best for: Organisations that need the option of a cloud or on-premises WAF from a long-standing application security brand.
open-appsec
Best for: Teams tired of tuning rules that want an open source WAF using machine learning instead of signature updates.
OWASP Coraza
Best for: Developers who want an open source WAF engine compatible with the OWASP Core Rule Set to build into their own proxies.
Sucuri Website Firewall
Best for: Small businesses and website owners that want a firewall bundled with malware cleaning and monitoring for their site.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Edge service, cloud add-on or self-hosted engine?
Edge services sit on a content delivery network between visitors and your server. You point your domain at them and they filter traffic before it reaches you, which also helps with speed and denial of service attacks. Cloud add-ons are the WAFs your cloud provider sells, managed in the same console as your servers. Self-hosted engines run on your own infrastructure, often as a module in a web server or reverse proxy.
Most small and mid-sized businesses are best served by an edge service, because there's nothing to install and rules update without you. Self-hosted engines make sense when traffic can't leave your network or you've got people who enjoy writing rules.
What OWASP says about tuning a WAF
OWASP describes a WAF as an application firewall that applies a set of rules to an HTTP conversation, generally covering common attacks such as cross-site scripting and SQL injection. It also says the effort to customise a WAF to an application can be significant.
That second point is the one buyers skip. Default rules either block real customers, such as someone pasting a code snippet into a support form, or let attacks through because they're too loose. Plan for a learning period in monitoring mode before you switch blocking on.
Questions to ask before you choose
- Where is the site hosted today, and will that change?
- Do we need protection for APIs as well as web pages?
- Can it run in monitoring mode before it blocks anything?
- Who will review false positives, and how quickly?
- Does it cover bots and denial of service, or only application attacks?
- Can rules be managed as code alongside the rest of our setup?
Signs your site needs a WAF now
- You take logins or payments. Those forms are the first thing attackers probe.
- You run a popular CMS. Plugins and themes get new vulnerabilities all the time.
- Your logs show odd requests. Strings of code in search boxes are a clue.
- You can't patch quickly. A WAF can cover the gap while you update.
Do you make a web application firewall? Tool makers can ask to be considered for a featured place on this list.
My plain advice on picking a WAF
Start with where your traffic already flows. If the site sits behind a content delivery network, its firewall is the easiest first step. If everything lives in one cloud, that provider's firewall keeps rules next to your servers. Choose a self-hosted engine only if you've got someone to own it.
Whatever you pick, run it in monitoring mode for a while and read the logs before blocking. A WAF is one layer, not the whole plan, so keep patching and backups going too. My notes on improving your business security cover the other layers.
Frequently asked questions
What does a web application firewall do?
It inspects web requests to your site and blocks ones that look like attacks, such as SQL injection or cross-site scripting, before they reach your application.
Is a WAF the same as a network firewall?
No. A network firewall controls which connections are allowed. A WAF reads the content of web requests, so it can stop attacks hidden inside normal-looking traffic.
Do small websites need a WAF?
Any site with a login, a form or a checkout can benefit. Many edge services include one, which makes it an easy step for small sites.
Are there free or open source WAFs?
Yes. Several tools in the table name an open source edition on their own site. Check the free plan column for each one.
Can a WAF block real customers?
Yes, if the rules are too strict. That's why it's worth running in monitoring mode first and reviewing what it would have blocked.
Does a WAF replace patching?
No. It buys time when a new vulnerability appears, but the fix is still to update the software underneath.
