WAF: The Firewall That Guards Your Site 24/7

A classic firewall guards the network: it decides which ports and protocols get through. But attacks on websites today don''t come through exotic ports — they come through the same port 443 your visitors use, wrapped in seemingly normal HTTP requests. That''s where a WAF, a Web Application Firewall, comes in: it doesn''t just look at where a request comes from, but at what''s inside it.

What a WAF protects you from

• SQL injection — an attacker puts SQL code into a search or login field, trying to extract or delete data from your database. A fixture at the top of the OWASP list of most common attacks for years.
• XSS (Cross-Site Scripting) — injecting malicious JavaScript that runs in your visitors'' browsers, for example to steal their sessions.
• Brute force attacks — automated password guessing against wp-login.php, often thousands of attempts per hour.
• Known plugin vulnerabilities — when a hole is found in a popular WordPress plugin, bots start mass-scanning the internet within hours, looking for sites that haven''t patched it. WAF rules are updated faster than most owners update their plugins — this is called virtual patching.
• Malicious bots and scrapers — traffic that burns resources, steals content, and probes for weak spots.

How a WAF works in practice

Every request to your site first passes through the WAF, which checks it against thousands of rules: known attack patterns, suspicious URL parameters, unusual headers, IPs with bad reputation. A legitimate request passes in under a millisecond — the visitor notices nothing. A suspicious one gets blocked, challenged with a CAPTCHA, or throttled. Modern WAFs run at the CDN level, meaning the attack is stopped geographically far from your server, before it consumes any of your resources.

Does a small site really need a WAF?

Yes — arguably more than a big one. Attacks on small sites are almost entirely automated: bots don''t pick targets by size, they scan millions of sites and hit every one with a known vulnerability. An average unprotected WordPress site receives hundreds of malicious requests a day — the owner never sees them until something breaks. Cleaning up a hacked site costs hundreds of euros and days of downtime (while Google may flag it as dangerous in the meantime), whereas a WAF deflects that same attack silently.

What a WAF is not

A WAF is not a substitute for basic hygiene: keeping WordPress and plugins updated, strong passwords, and backups are still on you. A WAF is a seatbelt — it drastically reduces risk, but it doesn''t mean you can drive with your eyes closed. The ideal setup for a small site: WAF + automatic daily backups + regular updates. That covers over 95% of real-world threats.

How to get one

You can buy a WAF as a standalone service (Cloudflare, Sucuri — from around $20/month for serious rulesets) or choose hosting that includes one. With us, a WAF — along with DDoS protection and a free global CDN — is part of every plan, starting at €4.20/month, with zero configuration: turn on the hosting and the protection is live. If your site runs WordPress, also take a look at our WordPress hosting, where the rules are further tuned to the most common WordPress attacks.