Web application and API protection (WAAP) is a set of security controls that protect public-facing web applications and APIs. It combines a web application firewall (WAF), API protection, bot management and distributed denial-of-service (DDoS) protection, usually delivered as a cloud service that sits in front of your applications. WAAP inspects incoming traffic and blocks attacks before they reach your servers, without changing the application’s code.
At a glance
- WAAP protects websites, customer portals and APIs that you build or host yourself.
- It typically bundles a web application firewall, API security, bot management and DDoS protection.
- Most WAAP runs as a cloud reverse proxy, often on a content delivery network (CDN), in front of your servers.
- It protects inbound traffic to your applications, not your employees’ outbound web use.
- Rules need tuning so legitimate customers and integrations aren’t blocked.
What problem it solves
Any application on the internet is probed constantly by automated tools looking for known vulnerabilities. Common attacks include injection attacks such as SQL injection and cross-site scripting, attempts to exploit newly disclosed flaws before you can patch, and credential stuffing, where bots try stolen username and password pairs against your login page. Bots also scrape prices and content, create fake accounts and hold inventory. Volumetric DDoS attacks can take a site offline.
APIs widen the problem. Mobile apps, partner integrations and single-page web apps all rely on APIs, and companies often don’t have a complete inventory of what is exposed. A traditional WAF built around web pages may not understand API traffic well. WAAP brings these protections together so an application team doesn’t need separate products for each.
How it works
Placement. In the most common setup, you point your application’s DNS at the WAAP provider. Traffic goes to the provider’s edge, is inspected and then forwarded to your origin servers. Your servers should be configured to accept traffic only from the provider. Some WAAP products can also run as software in your cloud environment or as an appliance.
Web application firewall. The WAF inspects HTTP and HTTPS requests against rules that recognize common attack patterns, such as the categories in the OWASP Top 10. Providers update managed rule sets when new vulnerabilities appear, which can buy time before you patch (often called virtual patching).
API protection. API features may include discovering APIs from traffic, validating requests against an API schema, enforcing authentication and applying rate limits per client. Depth here varies considerably between providers.
Bot management. Signals such as device characteristics, behavior and reputation are used to tell humans, good bots (such as search engines) and bad bots apart. Suspicious clients can be challenged, slowed or blocked.
DDoS protection. The provider’s network absorbs large floods of traffic and filters application-layer attacks that try to overwhelm the site with requests.
When it matters for buyers
- When you launch or grow a customer-facing application. E-commerce, portals and public APIs are common candidates.
- When a customer, partner or payment standard requires it. Security questionnaires and frameworks such as PCI DSS ask how public applications are protected.
- After credential stuffing, scraping or a DDoS incident. Often the event that starts the purchase.
- When moving applications to the cloud. A good point to replace an on-premises WAF appliance.
- When your CDN contract renews. WAAP is often bought from the same provider as the CDN.
Questions to ask vendors
- Which components (WAF, API protection, bot management, DDoS) are included, and which are add-ons?
- How do you discover APIs, and can you validate traffic against our API schemas?
- How are managed rules updated for new vulnerabilities, and how quickly?
- How do we tune rules and test changes without blocking real customers?
- How is DDoS attack traffic billed?
- What logs and alerts can we send to our SIEM?
- Do you support all the places our applications run, including multiple clouds and on-premises?
How it differs from a WAF
A web application firewall is one component of WAAP. Many WAF products now include API, bot and DDoS features, so the line is blurry. In general, “WAAP” signals a single service covering all four areas, while “WAF” may mean rule-based HTTP filtering only.
How it differs from a network firewall
A network firewall controls which connections are allowed between networks by address, port and application. It may allow web traffic through to your server but doesn’t understand application-level attacks hidden inside valid requests. WAAP specializes in inspecting that web and API traffic. For bot defense, API discovery and rollout patterns, see our Web Application and API Protection guide.
Problems this helps with
- Public websites and APIs being attacked or scraped
- Bots stuffing stolen passwords into customer login pages
- DDoS attacks taking the website or customer portal offline
- Not knowing which APIs are exposed to the internet
