WAF glossary: the words behind the rules

• Web application firewall is a layer that inspects requests before they reach an application and decides whether to pass them on. The information question, what one is and what it can and cannot do, is answered on its own page here.
• DDoS attack is an attempt to make a service unavailable by overwhelming it with traffic or work from many sources at once. The full definition, how attacks work and how DoS differs from DDoS are on what is a DDoS attack.
• IP spoofing is sending packets with a forged source address. It powers reflection and SYN floods, and it cannot carry an ordinary web request; the rest is on what is IP spoofing.
• OSI model is the seven-layer reference for naming where network communication happens, from the physical signal at layer 1 to the application at layer 7. Security uses it to say which defence can see which attack; see the OSI model.
• Layers 3 and 4 are the network and transport layers: IP addresses and routing, then TCP and UDP ports and connections. Floods and state attacks aim there, below any request; see what are layers 3 and 4.
• Layer 7 names the level at which requests are meaningful as requests rather than as packets: methods, paths, headers, and bodies. It is the level a request-inspecting layer works at, and the reason it cannot see what never becomes a request. How attacks divide by level is on attack layers.
• Virtual patching is blocking the requests that exploit a known weakness while the weakness itself remains in the application. It buys time rather than fixing anything, and treating it as a fix is where the practice goes wrong.
• Zero-day describes a weakness for which no fix is available yet, from the point of view of whoever has to defend against it. The term says something about the state of the fix, not about how sophisticated the attack is, and an unremarkable technique against an unpatched weakness qualifies just as much as an ingenious one.
• Exploit is code, a crafted input or a sequence of steps that uses a vulnerability to make a system do something unintended. The vulnerability is the weakness; the exploit makes it usable; see what is an exploit.
• Honeypot is a decoy with no legitimate use, set out to attract attackers, so any contact with it is worth an alert. On websites it is a hidden form field only bots fill in; see what is a honeypot.

Keeping those apart is what stops a definition from becoming a bad guide.

An entry here tells you what a word means. What attacks look like and how they divide is under attacks, which rules apply and where they come from under rules, automated traffic under bots, and the question of how to introduce filtering without breaking anybody under operations.

A term with a section of its own is not repeated here, which is why this list is short. Everything about denial-of-service traffic belongs to the attacks section, and everything about recognising automation to the bots section. A glossary that duplicated them would compete with the pages that cover them properly, and the reader would land on whichever version the engine happened to prefer.

Four entries are the usual starting points: what a web application firewall is and cannot do, why zero-day describes the fix rather than the attack, what layer 7 means for filtering, and how virtual patching buys time until a fix exists.