Vulnerabilities
What is a WAF, and when is it worth paying for one?
Published 2026-07-14 · Last updated 2026-07-14 · Vantyris editorial
A WAF (Web Application Firewall) sits in front of your website and inspects every HTTP request before it reaches your server. It can block SQL injection probes, credential-stuffing bots, and scripted attacks against /wp-login.php. It cannot fix a missing DMARC record, an expired TLS certificate, or an admin panel you left on the public internet. For most UK small businesses, the question isn't 'should I buy a WAF' but 'have I closed the hygiene gaps a WAF can't see yet?' This article explains what a WAF actually does, where it fits in a sensible security stack, and when the spend makes sense.
What this means for your business
- A WAF is a filter on web traffic, not a scanner. It reacts to patterns in live requests (bad URLs, suspicious payloads, bot signatures). It does not audit your DNS, email authentication, TLS configuration, or whether port 3389 is open on your office router.
- Managed WAFs (Cloudflare, Sucuri, AWS WAF, vendor bundles on hosting panels) trade monthly cost for someone else tuning rule sets. Self-hosted options (ModSecurity on Nginx/Apache) trade engineering time for lower recurring fees.
- For WordPress-heavy SMB sites, a WAF often blocks the noisy bot traffic that hammers /wp-login.php and xmlrpc.php. That reduces server load and cuts off a common entry path, but it does not replace patching plugins, enforcing 2FA, or removing user enumeration.
- NCSC guidance treats web application firewalls as one layer in depth, not the first layer. Email authentication (SPF/DKIM/DMARC), TLS hygiene, and closing exposed admin ports typically deliver higher impact per pound for non-technical owners.
How to fix
Run a hygiene baseline first (TLS, headers, DMARC, exposed ports). If you still see sustained application-layer attacks or you handle sensitive forms without a developer on call, add a managed WAF at your CDN or host. Tune rules in log-only mode before blocking.
- Baseline what a WAF cannot fix. Run a passive external scan (Vantyris free teaser or equivalent) and close high-confidence findings first: enforce DMARC beyond p=none, fix expired certificates, add HSTS and a sensible CSP, close RDP/SSH on the public internet. A WAF in front of a site with p=none DMARC still leaves your brand impersonatable by email.
- Decide where the WAF will sit. Most SMBs put the WAF at the CDN edge (Cloudflare orange-cloud, Sucuri reverse proxy) because it sees traffic before it hits origin. If you have no CDN, check whether your host offers a one-click WAF add-on. The WAF must terminate TLS or see decrypted HTTP from a trusted upstream; a WAF that only sees encrypted blobs cannot inspect payloads.
- Start in detection-only mode. Enable the WAF in log/challenge mode for 1-2 weeks. Review what it would have blocked: real attacks vs false positives on your booking widget, payment callback URLs, or admin paths. Only switch managed rule sets to block mode once false positives are understood.
- Pair the WAF with rate limits on auth surfaces. Add explicit rate limits on /wp-login.php, /xmlrpc.php, and any custom admin URL. A WAF without rate limiting still allows slow credential stuffing. Cloudflare's free tier includes basic bot fight mode; paid tiers add OWASP core rule sets.
- Re-scan after the WAF is live. A passive hygiene scan will still flag the same TLS/DNS/header issues; the WAF does not change those grades. What changes is your resilience to application-layer noise. Document the WAF vendor, rule mode, and who gets paged when the WAF blocks legitimate traffic.
Owner: Site owner prioritises; web host or CDN panel for WAF toggle; developer for custom rule exceptions. · Time: Hygiene baseline: 1-2 hours spread over a week. WAF rollout in log mode: 30-60 minutes; tuning: ongoing first month.
Common gotchas
- Don't buy a WAF to compensate for an unpatched plugin. A WAF might block some exploit payloads, but a determined attacker with a fresh CVE still needs patching at source.
- Don't enable aggressive OWASP rules on day one without testing checkout, contact forms, and webhooks. Payment providers and CRM embeds often trip generic SQLi rules.
- Don't assume 'we're on Cloudflare' means a WAF is on. DNS orange-cloud alone is CDN/DDoS; the WAF rule sets are a separate toggle on many plans.
- A WAF on the website does nothing for email impersonation, leaked credentials reused on other services, or an employee opening a phishing link.
How to verify the fix
Check your CDN/host dashboard for blocked-request counts after a week in block mode. Run a Vantyris verified scan to confirm TLS, headers, and DNS findings are still tracked independently of the WAF. Attempt a few benign admin URLs yourself from a clean IP; confirm you are not locked out by an over-broad rule.
Cyber Essentials alignment
This finding informs the following UK NCSC Cyber Essentials control areas:
- A1. Firewalls — boundary protection between the internet and your services.
- A2. Secure configuration — devices and services hardened against the inherent default vulnerabilities.
Vantyris is not a CE certifying body. The mapping above is informational.
Common follow-up questions
Is a WAF the same as a vulnerability scanner?
No. A scanner looks for misconfigurations and known weaknesses (certificates, headers, DNS, exposed services). A WAF filters live traffic. You want both roles filled, but not by the same product category.
Do I need a WAF if I only have a brochure WordPress site?
Often not at launch. If DMARC is enforced, TLS is current, admin login is rate-limited, and plugins auto-update, many brochure sites run fine without a paid WAF. Revisit when you add ecommerce, patient intake forms, or see sustained bot traffic in server logs.
What does a WAF cost for a small business?
Managed edge WAFs range from free basic bot protection (Cloudflare) to roughly £20-200/month for SMB-focused bundles (Sucuri, some host add-ons). Enterprise WAF contracts are a different category entirely. Budget for tuning time, not just the licence.
Can Vantyris replace a WAF?
No. Vantyris is a passive external hygiene scanner with workflow, PDFs, monitoring, and plain-English findings. It tells you what to fix and tracks whether grades move. A WAF blocks live attack traffic in real time. Use Vantyris to prioritise fixes; add a WAF when application-layer noise or compliance pressure justifies it.
References
Related explainers
- What a passive security scan can and cannot prove about your site.
- Content Security Policy: the header that stops most XSS attacks dead.
- WordPress REST API user enumeration: what it leaks, and the exact fix.
Want Vantyris to scan your domain for this and 80 other findings?
Free teaser scan, no card. Verified scan from €10 with the full workspace around it: workflow, score trend, three PDF layouts, share links, monitoring.
Vantyris editorial team · methodology v1.0.0