WAF glossary: the words behind the rules

Web application firewall is a layer that inspects requests before they reach an application and decides whether to pass them on. The information question, what one is and what it can and cannot do, is answered on its own page here.

Layer 7 names the level at which requests are meaningful as requests rather than as packets: methods, paths, headers, and bodies. It is the level a request-inspecting layer works at, and the reason it cannot see what never becomes a request. How attacks divide by level is on attack layers.

Virtual patching is blocking the traffic that exploits a known weakness while the weakness itself is still there. It buys time rather than fixing anything, and treating it as a fix is where the practice goes wrong.

Zero-day describes a weakness for which no fix is available yet, from the point of view of whoever has to defend against it. The term says something about the state of the fix, not about how sophisticated the attack is, and an unremarkable technique against an unpatched weakness qualifies just as much as an ingenious one.

Keeping those apart is what stops a definition from becoming a bad guide.

An entry here tells you what a word means. What attacks look like and how they divide is under attacks, which rules apply and where they come from under rules, automated traffic under bots, and the question of how to introduce filtering without breaking anybody under operations.

A term with a section of its own is not repeated here, which is why this list is short. Everything about denial-of-service traffic belongs to the attacks section, and everything about recognising automation to the bots section. A glossary that duplicated them would compete with the pages that cover them properly, and the reader would land on whichever version the engine happened to prefer.