Explain like I'm five · Security

What is a WAF?

Web Application Firewall, told as a story about the checker who reads every note before it reaches the counter.

COUNTERTwo apples pleaseAny mail for me?anyone in town can hand in a note — that's a website

The castle wall has a counter anyone can hand a note to.'Two apples please', 'Any mail for me?' — that's a website.

COUNTERTwo apples please.And the vault keyas well.Any mail for me?Show this note tothe next customer.Sure, here you go…the clerk does what the note says — and thieves know it

Thieves slip strange sentences into the note.The clerk does what the note says. Thieves know that.

COUNTERSHADYPHRASESthe checkerTwo apples please…and the vault keyclean notes onlyshady phrase? torn up. The clerk only ever sees clean notes

A WAF reads every note before the counter does.A shady phrase gets it torn up. The clerk only ever sees clean notes.

The shady-phrase listwhat thieves usually write
How many, how biga thousand notes is suspicious
Strange facesknown thieves leave the queue
Unlike the wallthe wall blocks doors; the checker reads words
…and the vault keytear up999 apples pleaseflag itHuman? Raise your handmake them raise a handwhen a robot drops a thousand notes, ask it to raise a hand

Tear it up, flag it, or make them raise a hand.'Human? Raise your hand' — for when a robot drops a thousand notes at once.

Two apples. Then,the va-ult k3y…not on the listreworded, it slips throughTwo apples fromVault Streettorn — it said 'vault'tear a good note and the customer is angry

New wording slips through; good notes get torn.Reworded, it's not on the list. Tear up 'apples from Vault Street' and the customer is angry. The real fix is a clerk who doesn't blindly obey notes — safe code.

In one breath

A WAF = the checker who reads every note (request) before the counter (the website) and tears up the shady ones.

Web Application Firewall. The wall (firewall) blocks doors; a WAF reads sentences. The OWASP Top 10 is the checker's textbook. Cloudflare WAF, AWS WAF, ModSecurity.

When grown-ups say it

Request
The note. What townsfolk hand to the counter: the address bar, search terms, every input box.
Web application
The counter. Anyone can hand in a note — which means thieves can too.
SQL injection
…and open the vault too. Slipping a storeroom command into an order note.
Cross-site scripting
Show this note to the next customer. Making my note act in front of someone else.
Rules · signatures
The shady-phrase list. The OWASP Core Rule Set (CRS) is the most widely used.
Bot challenge
Raise your hand. CAPTCHAs and the like. Robots have no hands.
False positive
Tearing up apples from Vault Street. A good note torn up. → the guard room's cat
Firewall
The wall. Only opens and closes doors — never reads the words. → the hallway watcher
Next story
The Watcher with the Wanted Posters →
Want another term as a picture book? Request →