Web Application Firewall (WAF)

A Web Application Firewall (WAF) is basically like a normal firewall you'd have on your own PC, but a much more complex one for screening all requests made to your website for potential security vulnerabilities they might exploit.

Like other security measures, it's not a solution to security problems in itself, but is another layer you can add, and certainly one of the best ones due to the form of protection it provides.

Advantages of WAF

The Unsleeping Eye

Strictly speaking, many features of WAFs don't protect against things you couldn't do yourself - e.g. often they screen for potential XSS or CSRF vulnerabilities, or potential vulnerabilities that could be exploited in the operating system of the webserver, and so forth. Careful coding could mitigate most of these on its own, but then - that requires careful coding, and none of us are that good.

A WAF, on the other hand, does not have bad days when it didn't have coffee that morning, or miss security updates we might not know about. It never sleeps... it sees all. Since the WAF is a service maintained by a whole bunch of security experts, it will be updated without you having to do anything if new threats emerge, which is a very significant advantage.

It doesn't tend to be (that) expensive

A WAF normally has some flat fee based on how many screening rules you give it, and then a scaling fee based on the number of requests it has to screen (e.g. in millions). This isn't likely to be anywhere near your biggest cost as these fees aren't high - it can be considerable on a high traffic website, but other costs are still going to be far higher, like CDN bandwidth.

Disadvantages of WAF

Depending on the provider and your site infrastructure, can be awkward to set up

For some sites, setting up a WAF to protect your site is fairly easy, but for others it can be a bit of a nightmare if you don't have good instructions. AWS in particular, where Lightsail is concerned, is something of a nightmare to set up WAF on without first knowing how (and the instructions aren't good for this).

The advantages of having a WAF severely outweigh the disadvantages. Use one.