Web Application Firewalls: Protecting Self-Hosted Apps from Attacks
SQL injection, XSS, brute force — self-hosted apps face real threats. A WAF is your first line of defense.
What Is a WAF?
A Web Application Firewall inspects HTTP traffic and blocks malicious requests before they reach your application. It protects against common attacks like SQL injection, cross-site scripting (XSS), and brute force login attempts.
Common Attacks a WAF Blocks
SQL Injection
Attackers inject SQL code through form fields to read or modify your database. A WAF detects SQL patterns in requests and blocks them.
Cross-Site Scripting (XSS)
Malicious JavaScript injected into web pages to steal user sessions or data. WAFs strip or block suspicious script content.
Brute Force
Automated attempts to guess passwords. WAFs rate-limit login endpoints and block IPs after too many failed attempts.
Path Traversal
Attempts to access files outside the web root using ../. WAFs normalize paths and block traversal attempts.
Bot Traffic
Scrapers, vulnerability scanners, and spam bots. WAFs identify and block automated traffic.
WAF Options for Self-Hosting
Cloudflare (Recommended)
Put Cloudflare in front of your server. Free tier includes basic WAF rules, DDoS protection, and CDN. The easiest option — just change your nameservers.
ModSecurity
Open-source WAF module for Nginx/Apache. Highly configurable with the OWASP Core Rule Set. More complex to set up but very powerful.
CrowdSec
Community-driven security engine. Analyzes logs, detects attacks, and shares threat intelligence. Think of it as fail2ban on steroids.
Simple Hardening Without a WAF
Even without a dedicated WAF, you can improve security:
Rate Limiting
Limit requests per IP per minute. Caddy, Nginx, and most reverse proxies support this natively.
Fail2Ban
Monitor authentication logs and ban IPs with too many failed attempts.
Security Headers
Set headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security.
Keep Software Updated
Most attacks exploit known vulnerabilities in outdated software. Regular updates are your best defense.
Our Recommendation
Use Cloudflare as a free WAF and CDN. It takes 5 minutes to set up and stops the vast majority of attacks before they reach your server.