WAF (web application firewall)
A filter in front of your app that reads every HTTP request and drops the ones that look like attacks before your code sees them.
See it
What it is
A WAF sits between the internet and your app, usually as a reverse proxy at the edge, and inspects each HTTP request: URL, headers, cookies, body. Requests that match attack signatures (an 'OR 1=1' in a query string, a script tag in a form field, a '../../etc/passwd' path) get blocked, challenged, or logged before your code runs. The canonical ruleset is the OWASP Core Rule Set, which is what most managed WAFs ship a tuned version of: Cloudflare, AWS WAF, Fastly, Azure Front Door, or self-hosted ModSecurity and Coraza.
Reach for one when you want virtual patching (a known CVE in a dependency you cannot upgrade until Friday, blocked at the edge today), when you need a fast lever during an active attack, or when compliance asks for one by name. Most WAF products also carry rate limiting, bot rules, and geo blocking in the same box, which is usually the real reason teams turn one on.
The gotcha is false positives. Generic rules do not know that your CMS legitimately posts HTML, or that your support form contains the word 'select', and a blocked customer never files a bug report. Always start in count or log-only mode, watch a week of real traffic, then tune before enforcing. And a WAF is not a fix: it is a filter in front of the bug, attackers get through with encoding and chunking tricks, and it sees nothing at all if traffic can reach your origin directly, so lock the origin to the proxy's IPs.
Ask AI for it
Put a web application firewall in front of this app. Enable the managed OWASP Core Rule Set in count-only mode first so I can review matches, then list the custom rules I should add: block requests to /admin from outside our office IP range, rate limit POST /api/login to 5 requests per minute per IP, and challenge traffic with no Accept-Language header. Add per-rule exclusions for our rich text editor endpoint, which legitimately posts HTML. Also lock the origin server so it only accepts traffic from the proxy, and show me the config for both the WAF rules and the origin firewall.