In this guide · 8 sections
Short answer
A WAF filters web traffic and blocks common attacks such as SQL injection and known plugin exploits before they reach your site. Most small sites benefit, and a basic one is free via Cloudflare or a WordPress security plugin. It does not replace updates, strong logins or backups.
What is a WAF, in plain English?
A normal network firewall decides which connections are allowed, by address and port. A web application firewall looks inside web requests: the address being requested, the form data, the cookies and headers. If a request looks like an attack, such as code injected into a search box, a known exploit for a WordPress plugin, or thousands of login attempts from one source, the WAF blocks or challenges it.
Think of it as a security guard at the door who knows the common tricks. The guard doesn't fix a broken lock on the back door, but stops a lot of people trying the front.
What a WAF blocks, and what it doesn't
The OWASP Top 10 2025 lists the most critical web application security risks, from broken access control and security misconfiguration to injection and authentication failures. A WAF is good at some of these and of little help with others.
A WAF helps with
- Injection attempts such as SQL injection and cross-site scripting
- Known exploits for popular plugins and software, once rules exist
- Brute-force login attempts and bad bots, with rate limits
- Probes for common files like old backups and config files
A WAF doesn't fix
- Weak or reused admin passwords
- Outdated plugins with flaws no rule covers yet
- Broken access control in your own site's logic
- Stolen admin sessions or a compromised staff laptop
- Data lost without backups
The practical message: a WAF buys you time and reduces noise, especially in the days between a vulnerability being published and you updating. Our guide to what to do when a WordPress plugin has a vulnerability shows why updates remain the real fix.
Edge WAF vs plugin WAF
There are two main places a WAF can run for a small business site.
Edge WAF (Cloudflare, host firewall)
Filters before your server- Bad traffic never reaches your hosting
- Works for any platform, not just WordPress
- Also gives you CDN caching and DDoS protection
- Needs your DNS pointed through the provider
Best for: Most sites, especially busy or frequently attacked ones.
Plugin WAF (e.g. Wordfence)
Runs inside WordPress- Understands WordPress users, plugins and logins
- Easy to install from the dashboard
- Uses your server's resources for every request
- Only protects the WordPress site it runs on
Best for: WordPress sites that can't change DNS, or as a second layer.
Many small WordPress sites use both: Cloudflare at the edge to absorb bulk attacks, and a security plugin for login protection and file scanning. Our Cloudflare setup guide covers putting a site behind Cloudflare without breaking email.
What a WAF costs (October 2026)
For a small business site, a useful WAF is cheap or free. Cloudflare's managed rules documentation says its Free Managed Ruleset, which covers high-impact and widely exploited vulnerabilities, is available on all plans, while the Cloudflare Managed Ruleset and Cloudflare OWASP Core Ruleset need Pro or above.
- Cloudflare FreeFree Managed Ruleset, DDoS protection, basic custom rulesUS$0
- Cloudflare ProAdds Cloudflare Managed and OWASP Core rulesetsUS$20/mo billed annually (US$25 monthly)
- Cloudflare BusinessFor sites where downtime costs real moneyUS$200/mo billed annually (US$250 monthly)
- WordPress security pluginFirewall inside WordPress plus login protectionFree tiers available; paid tiers vary
- Host-provided WAFCheck your hosting plan; quality variesOften included
Typical small business siteUS$0 to US$25 a month
Cloudflare prices from its plans page, approximate as of October 2026, before GST.
Prices are from Cloudflare's plans page. Paying more makes sense when the site takes payments or bookings directly, has been attacked before, or runs custom code that can't be patched quickly.
False positives: when the WAF blocks real customers
A WAF judges requests by patterns, so it sometimes blocks legitimate ones. Typical signs: a contact form that fails for some messages, a checkout that errors at payment, an admin page that won't save, or customers in some countries seeing a challenge page.
Turn rules on, then test the key journeys
Submit a contact form, place a test order, log in, upload an image and save a page in the admin area.
Read the WAF's event log
Edge and plugin WAFs log blocked requests with the rule that triggered. Match failed actions to log entries by time.
Add a narrow exception
Skip one rule for one URL path, such as the admin save endpoint. Don't turn the whole WAF off.
Re-test after every big site change
New plugins, themes or payment flows can trigger rules that were quiet before.
Does a small business website need a WAF?
For a WordPress, WooCommerce or other self-hosted site, yes: a free edge WAF or a security plugin is low cost and stops a lot of automated attacks. For a site on a fully hosted platform such as Shopify, Wix or Squarespace, the platform runs its own protection and you can't add a plugin WAF; focus on strong logins, MFA and staff access instead.
Whichever you use, the basics carry more weight than the WAF: keep software updated, remove unused plugins, use MFA on admin accounts, and keep off-site backups. If the worst happens, our website hacked guide covers recovery.
Do it yourself or get help?
Putting a site behind Cloudflare's free plan or installing a reputable security plugin is a reasonable DIY job if you are comfortable changing DNS and testing your forms afterwards. Get help if your site takes payments, runs custom code, or breaks when rules are switched on.
Our Website Security Hardening (S$290) sets up an edge WAF and login protection, tunes rules so forms and checkout keep working, removes risky plugins and confirms backups restore.
Frequently asked questions
A WAF is a filter in front of a website that inspects each web request, including form data, addresses and headers, and blocks requests that match attack patterns such as SQL injection, cross-site scripting or known software exploits. It can run at the edge, such as Cloudflare, or inside the site, such as a WordPress plugin.
For many small sites it is a good start. Cloudflare says its Free Managed Ruleset, available on all plans, covers high-impact and widely exploited vulnerabilities. Its fuller managed and OWASP rulesets need Pro, listed at US$20 a month billed annually as of October 2026. Sites taking payments may justify Pro.
You generally can't add your own WAF to a fully hosted platform, and the platform provides its own protection. Focus on what you control: strong unique passwords, MFA on every staff account, limiting staff permissions and removing old app access.
It reduces the risk by blocking many automated attacks and known exploits, but it cannot fix outdated plugins without matching rules, weak admin passwords or compromised staff devices. Keep WordPress, themes and plugins updated, use MFA and keep off-site backups alongside the WAF.
It is probably a false positive: a WAF rule is treating some form submissions as an attack. Check the WAF's event log for blocked requests at the time of the failure, then add a narrow exception for that rule on that form's address instead of turning the firewall off.