Website firewalls, (or application layer firewalls), use a series of configured policies to determine whether to block or allow communications to or from a website.

Traditional firewalls control data flow to and from the CPU, examining each packet as it passes through. A website firewall takes it further by controlling the execution of files or code by specific applications. This way, even if an intruder gains entry to a network or server, they can’t execute malicious code.

Website firewalls can be active or passive.

Active – Active website firewalls actively inspect all incoming requests—including the actual message being exchanged—against known vulnerabilities such as SQL injections, parameter and cookie tampering, and cross-site scripting. Only requests deemed “clean” are passed to the website.

Passive – Passive website firewalls act in a similar way to an intrusion detection system (IDS) in that they also inspect all incoming requests against known vulnerabilities, but they don’t actively reject or deny those requests if a potential attack is discovered.

Website firewalls are updated remotely and automatically, which allows them to prevent newly discovered vulnerabilities, almost in real-time. They’re often more up to date than specific security-focused code included in applications, due to the longer development and testing cycles required to include such code within applications.