A firewall is a gatekeeper for network traffic. It sits between a device or network and the outside world, looks at each connection, and lets it through or blocks it based on a list of rules. Your laptop has one built in, your office router has one, and many websites sit behind one.
How firewall rules decide what gets through
A basic network firewall reads the outside of each packet: the source and destination IP address, the port and the protocol. A typical web server rule set says: allow incoming traffic on ports 80 and 443 from anywhere, allow SSH on port 22 only from the office IP, block everything else. Modern "stateful" firewalls also remember outgoing connections so replies are let back in automatically.
A web application firewall (WAF) works higher up. It reads the contents of HTTP requests and blocks patterns that look like attacks, such as SQL injection strings in a form field or bots hammering a login page. The OWASP Core Rule Set is a widely used open-source set of WAF rules.
Firewalls you may already be using
- Operating system: Windows Defender Firewall and the macOS firewall filter incoming connections to your computer.
- Router: most office and home routers block unsolicited inbound traffic by default.
- Cloud: AWS security groups and similar settings act as firewalls around rented servers.
- Edge WAF: Cloudflare, AWS WAF and Sucuri inspect requests before they reach a site, often alongside a CDN.
A WordPress shop under login attack
A garden centre's WordPress store sees thousands of failed logins a day from scattered addresses. Putting it behind a WAF with a rate-limit rule on /wp-login.php and a challenge for unknown bots stops the noise before it reaches the server, which also lowers load and hosting costs.
How much a small business needs
Keep the firewalls on your computers and router switched on; that covers most offices. For a website on managed hosting or a modern builder, network-level filtering is the provider's job. A WAF is worth adding if you run a self-hosted CMS with plugins, handle logins or payments yourself, or are seeing bot traffic.
Firewall mistakes
- Opening a port "temporarily" for remote access and never closing it.
- Allowing all traffic from a wide IP range to fix a connection problem quickly.
- Thinking a firewall stops malware someone downloads and opens; that traffic was allowed.
- Letting visitors bypass the WAF by leaving the origin server's real IP reachable directly.
Related terms
- DDoS: floods that edge firewalls help absorb.
- Port: what most firewall rules are written around.
- IP address: the other main thing rules match on.
- CDN: often bundled with a web application firewall.