Ideally, a web application firewall is a first line of defense. (If you use one.) It’s effectively an advanced form of security through obscurity. It stops rout

Ideally, a web application firewall is a first line of defense. (If you use one.) It’s effectively an advanced form of security through obscurity. It stops routine attacks, reducing the work of the machines behind the firewall. If it’s your only protection against SQL injection, you’re going to learn WAF’s limitations at a very inconvenient time.