How to Set Up a Web Application Firewall (WAF) for Your Business Website

How to choose a WAF for your business site

Before diving into the technical setup, consider these criteria:

• Type of site you’re protecting: A static brochure site, an online store with payment processing, or a SaaS platform with many users. Each has a different risk profile.
• Level of control needed: Some cloud services offer only basic rules, while others let you manually add filters and block specific IPs or countries.
• Impact on speed: A good WAF adds minimal latency, but certain configurations can slow dynamic requests. Test with tools like PageSpeed Insights after deployment.
• Compatibility with SSL and CDN: If you already use a CDN, check whether the provider offers an integrated WAF (for instance, Cloudflare combines both).

Step-by-step: setting up a cloud WAF with Cloudflare

This example shows how to configure Cloudflare’s free WAF — often sufficient for initial protection of a small business website.

1. Create an account and add your domain

Sign up for Cloudflare, add your domain, and follow the instructions to change your nameservers. This routes traffic through Cloudflare’s network without changing your hosting.

2. Choose a security level

In the Security → Settings section, you can pick a Security Level. Options range from Essentially Off to I’m Under Attack. For normal operation, Medium is recommended — it issues a challenge only for suspicious behavior.

3. Configure Managed Rulesets

Cloudflare provides a free set of managed rules. Enable the “Cloudflare Managed Ruleset” package in the WAF tab. It blocks known attacks against common CMS platforms, SQL injection, and XSS.

4. Create custom rules (if needed)

Under WAF → Custom Rules, you can add filters for specific scenarios. For example, if your admin panel is at /admin, you could allow access only from your office IP address. An expression could look like:

• Field: URI Path
• Operator: contains
• Value: /admin
• Action: Block, with a condition to bypass if the IP matches your trusted address.

5. Test and monitor

After activating the rules, browse various parts of your site, submit a contact form, and perform a few searches. If everything works, leave the configuration running for 24–48 hours and check the firewall logs for false positives.

Testing your setup

Don’t rely only on smooth browsing. Run a few targeted checks to confirm the WAF is actually filtering threats.

• Simulate a simple attack: Enter <script>alert(1)</script> in a site’s search field or contact form. If the WAF works, the request should be blocked with a 403 error or challenge page.
• Inspect HTTP response headers: Use tools like curl -I or browser extensions. Look for headers such as x-sucuri-block, cf-ray, or server that indicate traffic passed through the protection layer.
• Review logs regularly: At least once a week, check WAF events. This helps detect attack attempts and fine-tune rules that might be blocking legitimate users.

Long-term maintenance

A WAF is not a set-it-and-forget-it tool. Security rules must evolve with your site and emerging threats.

• Keep your CMS and plugins updated: Even with a WAF, regular software updates reduce the attack surface.
• Review blocks: If customers report being unable to place an order, investigate whether the WAF is interfering.
• Train your team: If multiple people manage the site, explain what the WAF does and how to react when they encounter a 403 error.

As your business grows, you may need more sophisticated rules and integration with security monitoring. At that point, getting professional support becomes valuable. KG-SCRIPTS can help design a complete security configuration tailored to your site’s specific needs.

Conclusion

A WAF provides an extra security layer that complements — not replaces — good coding hygiene. Cloud-based services offer a quick start with minimal technical expertise. Spend a couple of hours on proper setup and testing; the investment is small compared to the risk of a breach, data loss, or reputational damage.