3 ms·

I don't know enough to comment about WordPress. But a secure applications don't need a WAF to be secure. WAFs in the steady-state are really just fuzzy bug inje

I don't know enough to comment about WordPress. But a secure applications don't need a WAF to be secure. WAFs in the steady-state are really just fuzzy bug injectors that hope to inject bugs over top of exploitable code. The main use for WAFs that I consider valid is emergency response to recently discovered vulnerabilities while a patch is being discovered and applied. The other use case is external rate limiting and DoS protection. But most often it is better to do that in the app anyways.

anakaine 5y ago
They do plenty more than that: - Can section off certain requests - Can rate limit - Can catch basic injection attacks With the wafs that integrate with WP such as wordfence they can also do things like: - Check for bad file permissions - Check for bad web server configuration - Recieve ruleset updates for zero days that are actually threat surface specific Having a WAF in place that is threat surface specific isn't as much about saying "its not needed if the code is good" as much as it is saying "the code might not always be good. We are not perfect. I'm at least going to have an extra layer or two of defence to try and stay safe(r) and give me some breathing room between an exploit and a patch".