{"id":18977,"date":"2026-10-22T17:00:14","date_gmt":"2026-10-22T14:00:14","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/what-is-waf-web-application-firewall\/"},"modified":"2026-10-22T17:00:17","modified_gmt":"2026-10-22T14:00:17","password":"","slug":"what-is-waf-web-application-firewall","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/what-is-waf-web-application-firewall\/","title":{"rendered":"What Is a Web Application Firewall (WAF) and How Does It Protect Your Site?"},"content":{"rendered":"
\n
In short<\/b>A web application firewall (WAF) is a layer that inspects every request to your site and compares it with rules that recognise attacks such as SQL injection<\/a>, XSS<\/a> and malicious uploads. Clean requests pass, and malicious ones are rejected before reaching WordPress or your code. It protects you even from a flaw in a plugin you have not updated yet, but it does not replace updating.<\/div>\n
\"Web<\/figure>\n

How is it different from a regular firewall?<\/h2>\n
\n\n\n\n\n\n\n\n
<\/th>\nRegular firewall<\/th>\nWeb application firewall (WAF)<\/th>\n<\/tr>\n<\/thead>\n
What it inspects<\/td>\nAddresses, ports and connections<\/td>\nThe content of HTTP requests<\/td>\n<\/tr>\n
Example<\/td>\nBlocks outside access to the database port<\/td>\nBlocks a request with SQL injection code in a search box<\/td>\n<\/tr>\n
Tool on our servers<\/td>\nCSF<\/strong><\/td>\nModSecurity<\/strong> and Imunify360<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

How does it work?<\/h2>\n
    \n
  1. A request arrives:<\/b> A visitor opens a page, submits a form or uploads a file.<\/li>\n
  2. It is checked against rules:<\/b> The firewall compares the URL and submitted data with rules for thousands of attack patterns.<\/li>\n
  3. Allowed or rejected:<\/b> A clean request continues to the site; a malicious one is rejected with a 403 message.<\/li>\n
  4. Logged:<\/b> Every rejected request is logged, and repeated attacks from one address may get it blocked.<\/li>\n<\/ol>\n

    What does it stop?<\/h2>\n
    \n
    1<\/i>SQL injection<\/b>Database commands inside fields and URLs.<\/span><\/div>\n
    2<\/i>XSS<\/b>JavaScript hidden in requests.<\/span><\/div>\n
    3<\/i>Malicious uploads<\/b>Such as a web shell<\/a>.<\/span><\/div>\n
    4<\/i>Known exploits<\/b>In plugins and themes not yet updated; this is called \u201cvirtual patching\u201d.<\/span><\/div>\n<\/div>\n

    What if a clean request is blocked by mistake?<\/h2>\n

    Sometimes a real request looks like an attack, such as saving a post that contains code. You see a 403 error when saving. Open a ticket with the URL and the time, and we will exclude the rule for your site only. Also read managing ModSecurity<\/a>.<\/p>\n

    A WAF does not replace updates:<\/b> it is an important extra layer, but the flaw is truly closed by updating the plugin or fixing the code.<\/div>\n
    \n

    How Hyyat Host protects your site<\/h2>\n