How a WAF works
A WAF usually runs as a reverse proxy at a CDN or hosting edge, though it can also run near the application server. It evaluates each HTTP request before forwarding allowed traffic to the app.
For HTTPS traffic, the connection must be decrypted at or before the WAF so it can inspect the request. Depending on its rules, the WAF may allow, log, block, rate-limit or challenge the client. A denial response can therefore come from the WAF rather than the application itself.
What a WAF checks
- Request structure: HTTP method, URL path, query string, headers, cookies and body size.
- Attack patterns: input associated with SQL injection, cross-site scripting, path traversal and unsafe file uploads.
- Client context: source IP reputation, location, request rate and past activity.
- Automation signals: unusual navigation, missing browser features or inconsistent fingerprints. These checks usually come from integrated bot detection features rather than basic WAF rules.
Rules may use exact matches, known attack signatures or risk scores. Poorly tuned rules can block legitimate clients, so site operators normally review logs and adjust narrow rules instead of disabling protection.
WAF vs traditional network firewall
This comparison describes a conventional Layer 3/4 network firewall. Next-generation firewalls may also inspect HTTP and other application-layer traffic.
| Feature | WAF | Traditional network firewall |
|---|---|---|
| Layer | HTTP application traffic | Network and transport traffic |
| Inspects | URLs, headers and bodies | IPs, ports and protocols |
| Protects | Web applications and APIs | Hosts and networks |
| Main limit | Doesn’t fix vulnerable code | Doesn’t interpret HTTP content |
Both controls can be used together. A traditional network firewall may allow HTTPS on port 443 while the WAF rejects a specific request sent through that connection.
Using proxies with a WAF-protected site
A proxy changes the source IP the WAF sees. It doesn’t change your cookies, request pattern, browser fingerprint or application behavior. A WAF or connected CDN may return 403 Forbidden, present a CAPTCHA or apply rate limiting when traffic breaks its policies.
To work within those controls:
- Check the site’s terms and published crawler rules before collecting data.
- Reduce request frequency and concurrency instead of cycling IPs to avoid a restriction.
- Honor
Retry-Afterwhen the site returns 429 Too Many Requests. - When testing your own app, review the WAF event log and rule ID, then allowlist a controlled test address if needed.
FAQ
Can a WAF block proxy traffic?
Yes, but not simply because a proxy is present. It may block an IP with poor reputation, excessive shared traffic or requests that match its security and automation rules.
Does a WAF return 403 or 429 errors?
It can return either. A 403 usually indicates that a rule denied the request, while a 429 indicates that the client exceeded a request limit.
Is a WAF the same as bot detection?
No. A WAF primarily filters malicious HTTP requests, while bot detection evaluates whether a client is automated and how it behaves. Many security platforms combine both functions.