What is a web application firewall (WAF)?
A web application firewall (WAF) is a filter that sits in front of your website and blocks suspicious traffic, such as known attack patterns and bots, before it reaches your app. Services like Cloudflare and Vercel offer one, often with a free or low-cost plan.
Also called: WAF
ON THIS PAGE
What it means
Without one, every request from the internet goes straight to your app, including scans for common weak spots like /.env or /wp-admin. A WAF looks at each request and drops the obviously bad ones.
A WAF is a safety net, not a replacement for fixing your code. It's most useful as a quick shield while you fix problems, and as protection against bot floods.
Why it matters for vibe-coded apps
New sites get probed within hours of going live. A WAF takes the background noise off your app so you can focus on real users.
- Bots that scan for leaked files and known bugs are blocked early.
- It can slow floods of requests that would otherwise run up your bill.
- It buys time to patch a newly announced vulnerability.
Example
Bots keep asking your site for secret files.
GET /.env -> reaches your server
GET /wp-admin -> reaches your server
GET /.git/config -> reaches your server# Cloudflare custom rule, action: Block
(http.request.uri.path contains "/.env") or
(http.request.uri.path contains "/.git") or
(http.request.uri.path contains "/wp-admin")Turn on the managed rule sets your provider offers, then add a few custom rules for paths you never use.
How to check if your app has this problem
- 1Check whether your domain sits behind a service such as Cloudflare or your host's firewall.
- 2Look at your server logs for repeated requests to paths you don't have.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Put your site behind a provider that includes a WAF.
- 2Turn on the managed rules and bot protection.
- 3Add rules to block paths you never use.
- 4Still fix the real problems in your code, the WAF is only a layer.
Help me set up a web application firewall for my site. List the managed rules to turn on, write custom rules that block requests for /.env, /.git and /wp-admin, and add a rate limit on my login and API routes.
Check if your app has this problem
Paste your website and we'll check for web application firewall (WAF) issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Rate limitingA cap on how many requests someone can make in a set time.
- Security headersSettings your site sends that tell browsers how to protect visitors.
- Zero-day vulnerabilityA security hole that attackers know about before a fix exists.
- SQL injectionAn attacker types database commands into your app and it runs them.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.