Hardening Reference
What a WAF reads that a packet filter cannot
Your contact form started returning 403 this morning and nothing in your code changed.
The short answer
A WAF inspects the contents of an HTTP request — path, headers, query string, body — and refuses the ones matching known attack shapes before your application is ever invoked.
That is a different job from the packet filter underneath it, which only ever decided whether port 443 should answer. The WAF is the layer that can tell a search query from an injection attempt in the same field, and the price of that judgement is the occasional false positive on your own traffic.
By the HostingFast team · Reviewed 12 August 2026
0
Hand-waving in this entry
100+
Entries wired to each other
Real
Numbers you can reproduce
Free
To read, no gate
Its value is almost entirely in how quickly its rule sets move. A plugin vulnerability goes public on a Monday; a maintained rule describing the exploit shape lands well before most site owners have read the advisory, and everything behind it is covered across the gap. The industry calls that virtual patching, and it buys days rather than months.
It is not a substitute for updating. A rule matches an attack somebody has already catalogued; an update deletes the flaw it was aiming at. Running only one of the two leaves a failure mode you can describe in advance, which is a poor way to find out about it.
Where in the request it actually runs
Server-level inspection happens before PHP is woken. On our protected plans that is Imunify, sitting under the application rather than inside it, which matters for two reasons: a blocked request never costs you a PHP worker, and the rules keep working even when the application itself has been compromised.
A plugin-based firewall inside WordPress cannot claim either. By the time it runs, PHP has booted, the database has been opened and the request has already cost you most of what it was going to cost. It still has uses, but it is not the same control.
The false positive you will actually meet
It will be a form or an API call, not an attack. Long text fields containing angle brackets, a page builder posting serialised JSON, a REST call to /wp-json, an admin-ajax.php action carrying a template — all of these can resemble a payload closely enough for a generic rule to fire, and the visitor simply sees 403.
The fix is narrow. Find the rule ID in the server log, then exempt that one rule on that one path. Turning the WAF off to rescue a contact form trades a permanent exposure for a five-minute inconvenience, and it is a trade nobody should make twice.
What inspection costs per request
Single-digit milliseconds on a sane rule set, and it lands on requests that miss the cache. A page served from LiteSpeed's cache never reaches the inspection stage at all, which is why a well-cached site can carry a full rule set without it showing up in time to first byte.
If you want the number for your own site, compare an uncached response time with the rule set active against the same request with it relaxed, using the same warm state both times. Measure it once, write it down, and stop guessing about it.
What it is not covering
Nothing about your credentials, your file permissions or your out-of-date PHP version. It reads requests; it does not audit your account. A compromised admin password produces perfectly legitimate-looking requests, and the WAF will pass every one of them.
Entries that finish this picture: Firewall, SQL Injection, Cross-Site Scripting and Malware. Mailboxes on your own domain are part of every hosting plan here, not an extra line at checkout.
Definitions with the mechanism left in
Most glossaries stop at the analogy. This one carries on to the part you needed: which layer the thing runs at, what it costs, and the log line or command that tells you it is working.
The rate you sign up at is the rate you renew at, so year two costs exactly what year one did.
- Layer stated for every term
- Log lines and rule IDs, not metaphors
- Cross-linked to the terms next to it
- Maintained by the support engineers
Why HostingFast
Standard on every plan
WAF, placed in the stack
Runs before PHP on a protected plan, which is why a blocked request costs you nothing at all.
The 403 you will actually get
Named the usual culprits — long text fields, /wp-json, admin-ajax.php — and the narrow exemption that fixes them.
Cost, measured not asserted
Single-digit milliseconds on uncached requests, and none at all on a cache hit.
Virtual patching, explained
What a rule set buys you between an advisory going public and your update window.
Clear about its blind spots
It reads requests. It has nothing to say about weak credentials or stale PHP.
Next reads mapped
Firewall, SQL Injection and Cross-Site Scripting are the three that complete it.
Quick Start
From order to online
- 1
Find the rule, not the symptom
Pull the rule ID out of the server log for the exact request that failed. Without it you are guessing, and guesses tend to end with the whole shield switched off.
- 2
Exempt one rule on one path
Scope the exception to the URL that needs it. A site-wide disable to rescue one form is the change you will still regret in six months.
- 3
Retest the request, then the page
Replay the exact failing submission, confirm a 200, and only then click through the page as a user. Fixing the wrong rule looks identical to fixing the right one until you check.
Built In
Loaded onto every plan
- DDoS filtering absorbed out at the network edge
- Daily backups, with self-service restores you run from the panel
- NVMe SSD storage on every tier, not just the expensive ones
- cPanel — the control panel most of the industry already runs
- Human support on duty every hour of every day
- Your existing site moved over by our engineers, free of charge
- Softaculous on board for one-click application installs
- A renewal price identical to the price you signed up at
- Zero setup charges — there is no joining fee, ever
- Money-back cover: 30 days on hosting plans, 7 on reseller
Frequently Asked
What people ask us most often
Will a WAF show up in my time to first byte?
On a cache miss, expect single-digit milliseconds from a sane rule set. On a cache hit it never runs, because LiteSpeed answers before inspection is reached. If your TTFB moved by hundreds of milliseconds, the rule set is not the cause and you should be looking at PHP, the database or an external call the page is waiting on.
My REST API calls started returning 403 — where do I look?
The server log entry for the blocked request names the rule that fired. Requests to /wp-json and admin-ajax.php are the two that trip generic rules most often, usually because a payload contains markup or serialised data. Send us the rule ID and the path and the exemption takes minutes; disabling the rule set site-wide to unblock one endpoint does not.
Can I tune the rule set myself?
On shared and WordPress plans the rules are maintained centrally and tuned per account by request, which is the trade for having them updated without you doing anything. On a VPS you own the whole configuration, including which rule sets you run and how aggressively. Ask before you buy if that control is the deciding factor.
Does a WAF mean I can slow down on updates?
No, and treating it that way is how sites get hit by the exact vulnerability they were told about. Rules cover the window between disclosure and your update; the update is what removes the flaw. WordPress Toolkit will apply core and plugin updates for you here, which makes the window shorter still.
Keep reading
SQL Injection
Where unparameterised queries come from, and the one line of PHP that ends them.
Cross-Site Scripting (XSS)
Output escaping, CSP headers and why an encrypted connection does nothing for you here.
How to Set Up a Firewall with UFW
The default-deny build, rule by rule, with the lockout mistake flagged before you make it.
Plesk Reseller Hosting
Plesk reseller accounts for teams whose muscle memory is already in Plesk.
DirectAdmin Reseller Hosting
DirectAdmin reseller hosting, lighter on the panel and lighter on the monthly rate.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Put it behind rules that update themselves.
Every plan carries the essentials other hosts bill as extras, and the support desk answers technical questions properly.
View Plesk Reseller Hosting plans