What does WAF stand for?
WAF stands for Web Application Firewall. A web application firewall: it inspects HTTP traffic to block web attacks such as SQL injection and XSS in front of an application.
A WAF sits in front of a web application and inspects HTTP and HTTPS requests and responses. It understands the application layer, so it can block attacks that look like ordinary web traffic to a network firewall: SQL injection, cross-site scripting, path traversal. It can run as an appliance, as software on the server or as a cloud service.
WAF in practice: an example
A request to a shop arrives with the search field set to a string that ends the query and adds OR 1=1. Port 443 is open, so the network firewall lets it through. The WAF recognizes the injection pattern in the parameter and returns an error page instead of passing the request on.
What WAF is confused with
WAF vs network firewall: what is the difference?
A network firewall filters by address, port and protocol. A WAF reads the content of web requests. You need both: they stop different things.
WAF vs IPS: what is the difference?
An IPS covers many protocols with general signatures. A WAF is specialized in web applications. What IPS stands for
Which exams cover WAF?
WAF is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: 4.1 (Security Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A web application is being attacked with SQL injection over HTTPS on port 443. Which control is designed to stop it?
- A packet-filtering firewall rule on port 443
- A WAF
- A longer TLS key
- MAC address filtering
Show the answer
B. A WAF. The attack is inside allowed web traffic. Only a control that inspects the HTTP request content, a WAF, can see it.
2. At which OSI layer does a WAF make its decisions?
- Layer 2
- Layer 3
- Layer 4
- Layer 7
Show the answer
D. Layer 7. A WAF analyses application-layer data: URLs, headers, parameters and bodies of HTTP requests.
Sources: NIST glossary: web application firewall. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.