Web Application Firewall (WAF) is an operation mode of application gateway that provides centralized protection of customer web applications from most common exploits and vulnerabilities.

WAF is based on rules from the OWASP core rule sets 3.0 or 2.2.9, which can also be customized. It automatically updates it self to include protection against new vulnerabilities and exploits, without any additional configuration.

Following features are currently included in the service: 

• SQL injection protection
• Cross site scripting protection
• Common Web Attacks Protection like command injection, HTTP request smuggling, HTTP response splitting, or remote file inclusion attack
• Protection against HTTP protocol violations
• Protection against HTTP protocol anomalies like missing host user-agent and accept headers
• Prevention against bots, crawlers, and scanners
• Detection of common application misconfigurations (that is, Apache, IIS, and so on.)