0
image EN
image English
Login Get Started
Firewall & WAF

Firewall + WAF -- L3, L4, L7, all of them.

Multi-layer firewall and Web Application Firewall protection. Network firewalls, cloud-native WAFs (AWS, Azure, Cloudflare), and managed WAF rules tuned for your application. Stop attacks at the perimeter.

Get Protected See WAF Plans
⚡ Multi-layer
🛡️ Managed rules
Defense in depth

Five firewall layers. Each blocks a different attack class.

L1

Edge network firewall

  • Cloudflare Magic Transit
  • AWS Network Firewall
  • Azure Firewall Premium
  • GCP VPC firewall
  • BGP flowspec, RTBH
  • 100+ Tbps edge capacity
Blocks volumetric, protocol
L2

Network ACLs + security groups

  • VPC subnet NACLs
  • Security group rules
  • Host-based iptables / nftables
  • Default-deny inbound
  • Egress filtering
  • Geo-IP blocks
Blocks scanning, lateral movement
L3

Cloud WAF (managed)

  • AWS WAF v2 + managed rules
  • Azure WAF + Front Door
  • Cloudflare WAF Pro/Business
  • GCP Armor Standard/Plus
  • Bot management
  • Rate limiting rules
Blocks OWASP Top 10
L4

Self-hosted WAF

  • ModSecurity + OWASP CRS
  • Coraza (Go WAF)
  • NAXSI (NGINX)
  • open-appsec (ML-based)
  • Custom rules per app
  • Virtual patching
Blocks app-layer attacks
L5

Application-level controls

  • API gateway (Kong, Tyk, AWS API GW)
  • Service mesh (Istio, Linkerd)
  • Schema validation
  • JWT + OAuth scope checks
  • mTLS for service-to-service
  • Custom business logic rules
Blocks business logic abuse
What we block

12 attack categories. All covered.

SQL injection

MySQL, PostgreSQL, MSSQL, NoSQL. 98% block rate, <0.02% false positives.

Cross-site scripting

Reflected, stored, DOM-based. CSP enforcement + WAF rules.

Path traversal

LFI, RFI, directory traversal. Encoded variants all caught.

Remote code execution

phpinfo, RCE payloads, deserialization. Virtual patching for new CVEs.

Brute force

  • Per-endpoint rate limits, account lockout, CAPTCHA escalation.

    • Credential stuffing

    Bot detection, JS challenge, fingerprinting, breach DB correlation.

    SSRF

    Internal IP blocklist, DNS rebinding protection, IMDSv2 enforcement.

    IDOR

    Per-resource authorization, JWT scope checks, custom app rules.

    API abuse

    Per-key rate limits, schema validation, business-logic rules.

    Scraping

    Bot detection, headless browser detection, fingerprinting, tarpitting.

    File upload abuse

    Content-type verification, magic byte check, AV scan, sandboxed processing.

    Session attacks

    Session fixation, CSRF token, secure cookie, same-site, expiration.

    The process

    4 steps to a production WAF, in 1 week.

    1

    Discovery

    Map your endpoints, traffic patterns, false-positive risk. Identify business-critical flows that must never be blocked.

    1-2 days
    2

    Baseline rules

    Deploy OWASP CRS in monitoring-only mode. Tune for 1 week. Identify false positives. Build allow/deny lists.

    5-7 days
    3

    Custom rules

    Add app-specific rules: per-endpoint rate limits, JWT validation, business-logic protections, virtual patches.

    2-3 days
    4

    Block mode + ongoing

    Switch to block mode. Monitor 24/7. Quarterly rule review. Continuous tuning as app evolves.

    Ongoing
    By the numbers

    Protecting 4,000+ applications against Layer-7 attacks.

    99.8%
    OWASP Top 10 block rate
    Across all managed deployments
    99.99%
    WAF availability SLA
    Active-active multi-region
    4 hours
    CVE disclosure to virtual patch
    Industry median: 14 days
    0.02%
    False positive rate
    Industry median: 0.5%
    Customer stories

    What teams say about our WAF service.

    "We were getting hit with 50,000 SQLi attempts per day from a single botnet. The WAF stopped 100% of them at the edge. Our origin servers never even saw the traffic."
    Priya Iyer
    Engineering Director, BookMyApp
    "A critical Apache CVE dropped on a Friday afternoon. The team had a virtual patch deployed by Sunday evening. We would have been vulnerable for 3+ weeks without this service."
    Michael Torres
    CISO, FinServ Global
    "Our API was being scraped and resold. The WAF + bot management stopped 99.7% of the scraping in the first week. Revenue recovered within the month."
    David Lee
    CTO, WorkStreamly

    Stop attacks at the edge. Get a managed WAF.

    Free assessment. OWASP Top 10 covered. Virtual patching included.

    Get Protected See WAF Plans