What is layer 7?

Traffic is described in layers, and each one sees less of the meaning than the one above.

At the lower levels there are addresses, ports, and packets. Something is travelling from somewhere to somewhere, and whether it is a shopping cart or an attack is not a question the level can answer, because the information is not there yet.

At layer 7 the pieces have been assembled into something intelligible. The request asks for a specific thing, in a specific way, with specific values, and it can be compared with what the same client asked a minute ago. That assembly is what makes judgement possible.

The term is used constantly in security discussions, and almost always to mark a boundary rather than to describe a level.

A defence operating here can act on what traffic means: which endpoint is being hit, whether a value looks like an attempt to inject something, whether one client is behaving unlike any person would. That is the entire category of decision unavailable at lower levels.

The boundary is the other half, and it is the part to carry away. Something that never becomes a request is not visible here at all. Traffic that saturates a link before arriving, connections opened and abandoned, floods aimed at the network rather than the application: none of that reaches the level where meaning exists, so no amount of rule-writing addresses it. Which defence sees what is set out under WAF vs other defences, and how attacks divide by level under attack layers.

That single fact explains most confusion in this area. When a product claims to handle everything, the useful question is which level it operates at, because the answer bounds what it can possibly observe.

How attacks divide across levels is covered under attack layers, and the rest of the filtering vocabulary in this glossary.