Web Application Protection

Hackers are hitting your website right now. Stop them at the door.

Password guessers, scanners and scrapers use up your servers, your budget and your evenings. Point your domain at WAP and they're turned away before they reach you.

Get a free evaluation Protect my site

3 steps to go live · no code changes · undo with one DNS change

edge.log

POST/login429 limited

GET/.env401 blocked

GET/checkout200 → origin

GET/%2e%2e/etc/passwd401 blocked

GET/products/42200 → origin

POST/login429 limited

How it works

Every request, every check, in one picture

Nine real visitors, eight checks in a fixed order. Each attack stops at the first check that catches it; everything else reaches your server, cleaned up and carrying your secret token.

Sound familiar?

The headaches WAP takes away

Peace of mind

“Someone is guessing passwords on our login all night.”

One rule limits /login to 10 tries a minute per address. The rest are turned away before your server sees them.

Saves money

“Our server bill went up, but real visitors didn't.”

Every visitor gets a fair-use ceiling and hostile networks are blocked in one line. Your servers only work for customers.

Saves time

“Our logs are full of scanners. We can't see the real problems.”

Attack tools, path-traversal tricks and junk methods are blocked automatically, from day one.

Peace of mind

“We just found out our .env file was public.”

Block /.env, /.git or any path in seconds, including every sneaky spelling like /%2eenv or //.ENV.

Saves money

“The site crawled during our biggest sale.”

Rate limits on heavy pages, request-size caps and origin timeouts keep capacity for paying visitors.

Approval

“A customer asked what protects our web app. We had no answer.”

Now you do: a security proxy in front of every site, a locked-down origin, and daily numbers to prove it.

Simple on purpose

Three steps. No project plan.

Sign inA one-time link by e-mail. No passwords.
Add your siteYour domain and where your server lives. Protection starts right away.
Change one DNS recordTraffic flows through WAP. Changed your mind? Point it back.

Free evaluation

Speak with the team.

Tell us your domain and what's hurting. An engineer will look at it with you and give you a straight answer, including "you don't need us for this" when that's the truth.

What's hitting your site, and what it costs you
The first rules worth switching on
No obligation, no credit card

Free, whether you sign up or not

Three things to do on your server today

Copy them, use them, share them with a friend who runs a website.

1. Find files that should never be public

Anything other than 403 or 404 needs fixing today.

for p in .env .git/config .DS_Store \
  server-status phpinfo.php backup.zip; do
  printf '%s ' "$p"
  curl -s -o /dev/null -w '%{http_code}\n' \
    https://example.com/$p
done

2. Rate-limit your login

Plenty for a human, far too few for a bot. In nginx:

limit_req_zone $binary_remote_addr
  zone=login:10m rate=10r/m;

location = /login {
  limit_req zone=login burst=5;
  proxy_pass http://app;
}

3. Don't let anyone go around you

Firewall the origin so only your proxy reaches ports 80/443.
Keep its IP out of DNS, MX records and mail headers.
Check crt.sh for old hostnames still pointing at it.
With WAP: reject requests without your team's secret X-WAP token.

How WAP compares

Honest about where others win

WAP doesn't do everything. Here's how it stacks up against the WAFs you're probably considering, including where they're ahead.

Run it in your own data centre

WAP deploys on-premises as well as hosted: your hardware, your network, your logs. Complete control, nothing leaves your perimeter.

Typically around 45% less

Compared with similar plans from the big providers, our sales team's quotes usually come in around 45% lower. Ask us for yours.

Managed signatures (SQLi, XSS, RCE)

WAP✓ OWASP CRS, per category

Cloudflare WAF✓
AWS WAF + CloudFront✓ managed rule groups
Google Cloud Armor✓ preconfigured rules
Fortinet FortiWeb✓
ModSecurity (Apache)✓ OWASP CRS

Run it on-premises

WAP✓ your data centre, full control

Cloudflare WAF✕ cloud only
AWS WAF + CloudFront✕ AWS cloud only
Google Cloud Armor✕ Google Cloud only
Fortinet FortiWeb✓ appliance or VM
ModSecurity (Apache)✓ self-hosted

Brute-force & per-path rate limits

WAP✓

Cloudflare WAF✓
AWS WAF + CloudFront✓ rate-based rules
Google Cloud Armor✓
Fortinet FortiWeb✓
ModSecurity (Apache)◐ custom rules

Bot management

WAP◐ UA + rate rules

Cloudflare WAF✓ advanced on higher plans
AWS WAF + CloudFront✓ Bot Control add-on
Google Cloud Armor✓ with reCAPTCHA
Fortinet FortiWeb✓
ModSecurity (Apache)◐ rules only

A person to talk to

WAP✓ an engineer from day one

Cloudflare WAF◐ on higher plans
AWS WAF + CloudFront◐ paid support plans
Google Cloud Armor◐ paid support
Fortinet FortiWeb◐ support contract or partner
ModSecurity (Apache)◐ community

Network (L3/L4) DDoS absorption

WAP✕

Cloudflare WAF✓
AWS WAF + CloudFront✓ Shield Standard
Google Cloud Armor✓
Fortinet FortiWeb◐ separate product
ModSecurity (Apache)✕

Based on each vendor's public documentation as of November 2026. Features and pricing vary by plan and change over time, so check the vendor before deciding. The 45% figure is the typical saving in OneFirewall sales quotes against comparable plans; yours depends on traffic and features. Product names are trademarks of their respective owners. Spot something out of date? Tell us and we'll fix it.

Full comparison: setup, cost and best fit →

For the engineer who signs off

Exactly what WAP stops

Every protection, how it works and what the attacker gets back.

SQL injection, XSS & remote code executionInjection · managed signaturesrule→ 401

The attack. Attackers hide database commands, scripts or shell commands in URLs, form fields, cookies and JSON bodies, hoping your application passes them on unchecked: ' OR 1=1--, <script>, ;cat /etc/passwd.

How WAP stops it. Switch on managed signatures for a site: the OWASP Core Rule Set, run by the ModSecurity engine, inspects the URL, headers and request bodies up to 128 KB. Choose the categories that apply to your stack (SQLi, XSS, RCE, LFI/RFI, PHP, Java, Node.js, scanners, protocol), a paranoia level from 1 to 4, and block or detect-only while you tune.

GET /p?id=1' OR '1'='1'--

Credential stuffing & brute forceAccount takeoverrule→ 429

The attack. Botnets replay millions of leaked username/password pairs, or guess passwords, against your login and password-reset endpoints at thousands of attempts per minute. One reused password is enough to take over an account.

How WAP stops it. Add a rate-limit rule on the sensitive path, e.g. /login at 10 requests per minute per client IP. Every attempt over the limit is answered with 429 at the edge, so your authentication backend and database never see it.

POST /login ×600/min

Application-layer floods & scrapingAvailabilityrule→ 429

The attack. Layer-7 floods send cheap HTTP requests that are expensive for you: search queries, report generation, cart operations. Aggressive scrapers do the same to copy prices and content. Both exhaust CPU, database connections and bandwidth.

How WAP stops it. A site-wide per-IP requests-per-minute ceiling caps every visitor. Offending networks can be blocked by CIDR, and changes reach every edge node's memory within seconds. Volumetric L3/L4 DDoS needs network-level scrubbing upstream of WAP.

GET /search ×5,000/min

Exposed admin panels & secret filesReconnaissance · data exposurerule→ 401

The attack. Automated scanners request well-known paths on every site they find: /.env with database passwords, /.git/config, /wp-admin, /phpmyadmin, /actuator, /server-status. One forgotten file can leak credentials or source code.

How WAP stops it. Block rules on a path prefix, exact path or substring stop these requests with 403 before they reach the origin. To keep an admin panel reachable from your office only, add an allow rule for your office IP range and a block rule for the path.

GET /.git/config

Path traversalFile disclosurealways on→ 401

The attack. ../ sequences in the URL escape the web root to read files such as /etc/passwd or application configs. Attackers percent-encode them (%2e%2e%2f), double-encode them (%252e) or use backslashes to slip past naive filters.

How WAP stops it. Always on. WAP decodes every path repeatedly, so double and triple encoding are unwrapped, and treats backslashes as separators. Any request whose path still contains a .. segment is rejected. Real browsers resolve these segments before sending, so legitimate traffic never trips this check.

GET /%252e%252e/%252e%252e/etc/passwd

Filter evasion by encodingRule bypassalways on→ 401

The attack. Path filters are often bypassed by writing the same URL differently: /%61dmin, //admin, /ADMIN, /public/../admin or \admin. The origin server normalises the path and serves the protected page anyway.

How WAP stops it. Before matching rules, WAP normalises every path: it percent-decodes, collapses duplicate slashes, resolves dot segments, converts backslashes and ignores case. One /admin rule covers every spelling, while the original URL is still forwarded unchanged to your origin.

GET //%61DMIN/./users

Vulnerability scanners & hostile botsReconnaissancerule→ 401

The attack. Tools such as sqlmap, nikto, nuclei and masscan map your application and probe for known CVEs, often hours after a vulnerability is published. Their requests also fill your logs with noise.

How WAP stops it. User-Agent rules block known tooling, and IP/CIDR rules block hostile networks. Because the User-Agent is chosen by the client, combine these rules with rate limits. Blocked requests are counted per site per day on your dashboard.

User-Agent: sqlmap/1.8

Client IP spoofingAccess-control bypassalways on→ replaced

The attack. Attackers send their own X-Forwarded-For or X-Real-IP header to look like an allow-listed address, to escape per-IP rate limits, or to plant a fake IP in your logs and audit trail.

How WAP stops it. Always on. WAP discards every forwarding header the client sends and writes X-Forwarded-For and X-Real-IP from the actual TCP connection. Rate limits and IP rules use that same verified address.

X-Forwarded-For: 10.0.0.1

Origin discovery & protection bypassBypassalways on→ rejected

The attack. If attackers find your origin's real IP address, through old DNS records, certificate logs or a mail header, they can go around any proxy and attack the server directly.

How WAP stops it. Every request WAP forwards carries your team's secret token in the X-WAP header: 12 random characters generated for your team, rotatable at any time, and never sent back to visitors. Allow only the WAP edge in your origin firewall and reject requests without the token. Direct hits then fail even when the IP has leaked.

GET / sent straight to origin IP

HTTP request smugglingDesyncalways on→ re-framed

The attack. Ambiguous framing, such as Content-Length and Transfer-Encoding in the same request, makes the proxy and the origin disagree about where one request ends. A hidden second request is smuggled past security checks or into another user's connection.

How WAP stops it. Always on. WAP fully parses each request and re-frames it for the upstream connection. When Transfer-Encoding is present, Content-Length is dropped, and hop-by-hop headers, including any listed in Connection, are stripped. The origin only receives framing that WAP generated.

CL: 4 + TE: chunked

Dangerous HTTP methodsMisconfigurationalways on→ 401

The attack. TRACE reflects the full request back, which can expose cookies and authorization headers (cross-site tracing). PUT, DELETE or PATCH left enabled by mistake can let attackers modify content.

How WAP stops it. Always on: TRACE and TRACK are blocked for every site. Method rules can block any other verb your application doesn't use, for example DELETE on a marketing site.

TRACE / HTTP/1.1

Oversized payloads & slow originsResource exhaustionalways on→ 413

The attack. Very large request bodies fill memory and disk on upload handlers. An origin that hangs ties up connections until nothing is left for real users.

How WAP stops it. Always on. Bodies over the platform limit (25 MB by default) are refused with 413. The limit is checked against the declared Content-Length and again while the body streams. Upstream connect and response timeouts end hung connections with 504.

POST /upload (4 GB body)

Host header abuse & open-proxy attemptsPoisoningalways on→ 401

The attack. Forged Host or X-Forwarded-Host headers poison caches and password-reset links. Attackers also try to use reverse proxies as open relays to reach arbitrary sites.

How WAP stops it. Always on. Only exact, registered host names are forwarded, to the origin their owner configured. Every other host gets 401 and is never proxied. X-Forwarded-Host is always set by WAP, never taken from the client.

Host: attacker.example

Not available yet: automatic TLS and domain verification. Volumetric (L3/L4) DDoS needs network-level scrubbing in front of WAP.

FAQ

The questions people actually ask

Does WAP inspect for SQL injection and XSS?

Yes. Turn on managed signatures for a site and every request is checked against the OWASP Core Rule Set: SQL injection, cross-site scripting, remote code execution, file inclusion and more. You pick the categories and the strictness, and can run detect-only first to see what would be blocked.

Can we run WAP on our own servers?

Yes. Besides the hosted edge, WAP can be deployed on-premises in your own data centre, so traffic, logs and configuration never leave your network. Ask us about it in a free evaluation.

Can I undo it?

Yes. Point your DNS back to your own server and WAP is out of the path. There's no lock-in, no agent to uninstall and no code to remove.

Will it slow my site down?

Rule checks run in memory and take microseconds. The real cost is one extra network hop between WAP and your origin, so it's smallest when your origin is close to the edge.

Do I need to change my application?

No. You add the site in the console and point your DNS at WAP. We recommend that your origin accepts traffic only from WAP and reads the visitor's IP from X-Forwarded-For.

How quickly do rule changes apply?

Within seconds. Configuration is stored in Postgres and pushed into the memory of every edge node through database notifications, so checking a request never waits on a database query.

What happens to traffic for domains that aren't registered?

It is answered with HTTP 401 and a page explaining that registration is needed. It is never forwarded anywhere.

Does WAP store my traffic?

WAP does not store request or response bodies. It keeps daily counters per site and, for unregistered domains, a small amount of request metadata for security analysis.

Does WAP stop volumetric DDoS?

WAP works at the HTTP layer (L7). Floods that saturate network links (L3/L4) need network-level scrubbing in front of the edge.

Who can sign up?

WAP is currently available to members of the OneFirewall Alliance. Sign-in is password-less, with a single-use link sent to your work e-mail.

Stop paying for traffic that's trying to hurt you.

Talk to us first, or start right away with your work e-mail.

Get a free evaluation Protect my site