Web application firewalls are one of the most critical security components that a website may need. By doing penetration tests for many clients that use Web application firewalls (WAF) I was able to get a very good idea about which one of them is the best.
Therefore, here is the list of the best Web application firewall I always recommend for my clients depending on the website size and budget:
- CloudFlare for small websites
- Sucuri for medium websites
- Akamai Kona Site Defender for big websites
The importance of WAFs comes from the fact that even after fixing your website vulnerabilities, they still their some zero-day’s vulnerabilities related to the libraries you use. In addition, when you discover a critical vulnerability in your website and you need to mitigate the risk, you will need a WAF to do it.
So, on this page, I am going to give you my honest review of the WAFs that I personally use and recommend to my clients. Some of these WAFs have an affiliate link but others do because as I said this is an honest review of the products.
The best WAF for small websites
The best WAF for small-size websites is Cloudflare. Actually, at this level, most companies and website owners try to focus on getting more traffic and they actually do not care too much about the security of their website (which is a bad idea by the way). Therefore, at this level, I mainly recommend my clients to choose a cheap WAF that can help them mitigate the risk and that at the same time will not cost too much. So the best solution would be the pro plan of CloudFlare that costs 20$/month.
I didn’t actually mention the free plan of Cloudflare as this one does not offer the web application firewall in this Free plan
Here is the list of the most important features that you will get from this plan:
- Web Application Firewall (WAF)
What I personally liked about this web application firewall, is that it has some custom rules depending on the CMS you are using. I mean if you are using WordPress or Joomla or any other CMS, then the firewall will include some custom rules that WordPress needs. That’s definitely awesome as on one hand this optimizes the firewall rules and makes it faster, and maximizes the detection of some attacks that are specific to the CMS you are using.
For example, sometimes a zero-day vulnerability is discovered in WordPress that for example gives full control. If you add this to the firewall, it will stop the attack even for a Joomla-based website which is stupid to do and will slow down the website performances.
- Unmetered Mitigation of DDoS
This feature helps you protect your website against DDOS attacks. However, to be honest with you, in general, at this level, you will not need protection against DDOS attacks, but having this kind of protection enabled is a good layer of security that you can add to your website.
- Global Content Delivery Network (CDN)
If you are starting your website, then you have definitely thought about using a CDN for your website to make it faster. So, by purchasing this plan you will get also a CDN for your website. What makes this option really good, is that implementing the CDN in Cloudflare is very fast and easy to do.
Cloudflare offers also an image optimizer that you will also need to use to reduce the loading time of your website.
The best WAF for medium size websites
For the medium size websites, the best web application firewall is the sucuri website security platform with at least a professional plan. At this level, the budget of the security is still not very important to get the most powerful web application firewalls in the market. In addition, you will be in need of much more functionalities that Cloudflare does not offer for their clients. Therefore, the sucuri professional plan that will cost you 299$/year is actually the best solution.
Now you may notice that I didn’t talk about the sucuri WAF solution. That is simply because the price nearly the same and with the security platform you get much more important functionalities and support. The WAF only will cost you 19.98$/month and the security platform with multiple functionalities including the waf is 24.99$/month.
The sucuri security platform offers a panoply of monitoring solutions that will help you get a detailed view of the security of your website at any moment. Here is the list of the most important component that you get from this platform :
- Malware & Hack Scan Frequency
- Malware Removal & Hack Cleanup
- Brand Reputation & Blocklist Monitoring
- Advanced DDoS Mitigation
- CDN Performance
- File Integrity Scan
You can check the best security monitoring system page to get a detailed idea about these functionalities with as always an honest recommendation about the monitoring solution.
The best WAF for big websites
The best Web application firewall for big websites with no physical infrastructure is the Akamai Kona Site Defender. The reasons behind this choice are the nature of needs that the website security program will have. Actually, at this level, the company will start thinking seriously about the security of their website as the number of treats grows dramatically.
The growth of the number of attacks will increase the number of alerts, which means more false positive, which could make the chosen solution useless. Akamai is more suitable for such situation and it is designed to reduce the number of False Positive.
If you don’t have the human resources or expertise to manage the solution, Akamai offers a great option for you. Akamai offers a managed security services for regular configuration tuning and 24/7 monitoring, and this what you will definitely need at this level (24/7 monitoring).
