WAF and CDN: When It Makes Sense, Which Ones Exist, How to Choose An honest guide to the two most misunderstood technologies in web security — and why so many companies use them wrong, overspend, or remain unprotected even with both in place.
WAF and CDN: When It Makes Sense, Which Ones Exist, How to Choose An honest guide to the two most misunderstood technologies in web security — and why so many companies use them wrong, overspend, or remain unprotected even with both in place. Introduction If you've gone through the recent posts in this series hardening web servers, configuring email authentication, protecting certificates, and closing ports, you've probably thought: "all this is great, but what if I put a CDN with WAF in front? Wouldn't that solve 80% of the problems at once?" The honest answer is: sort of . CDN and WAF are powerful tools that solve real problems, but they're also frequently used as a magical bandage that makes everyone sleep soundly while fundamental problems remain untouched. Worse: many people use WAF thinking they're protected when they're actually in "monitor only" mode for two years, or have rules so generic they block legitimate customers while letting real attacks through. Part 1: What a CDN is, really CDN — Content Delivery Network. The original idea from the 1990s: spread copies of content on servers around the world. By 2026, CDNs have evolved to do much more. 1.1 What a modern CDN does Static content caching — images, CSS, JS, fonts, videos closer to the user Dynamic acceleration — route optimization even for changing content TLS termination — certificate managed by the CDN Volumetric DDoS protection — absorbs attacks of hundreds of Gbps Bot management — detects and mitigates malicious bots Built-in WAF — practically all modern CDNs have one Edge compute — Cloudflare Workers, Lambda@Edge, Fastly Compute, etc. Image/video optimization — WebP/AVIF, adaptive transcoding Analytics and observability Failover and load balancing 1.2 What a CDN does NOT do Doesn't fix your application — slow PHP stays slow Doesn't replace backup — cache is not permanent storage Doesn't hide your origin by default — real IP remains discoverable Doesn't protect against attacks that look legitimate — slow brute force, account takeover Doesn't replace hardening — wrong configurations stay wrong Doesn't work magic on 100% dynamic content — checkout, authenticated dashboards Part 2: What a WAF is, really WAF — Web Application Firewall. Unlike traditional firewalls (layers 3-4), it operates at layer 7 — understands HTTP, knows web application semantics, decides based on content. 2.1 What a WAF does It intercepts every HTTP request and asks: Does this parameter have SQL injection patterns? Is this User-Agent from a scanner? Is this IP on a bad reputation list? Does this URL try to access wp-config.php? Does this request have XSS patterns? Is this client making 500 req/s (rate limit)? Does this request match a known exploit (Log4Shell, ProxyShell)? If yes: it blocks, challenges (CAPTCHA), logs, or flags. 2.2 Rule types Negative security model (blacklist): "Everything allowed, except this." Standard for most. ModSecurity + OWASP CRS is the classic example. Works out-of-the-box, generates false positives. Positive security model (whitelist): "Only allowed what matches this." Much safer, exhausting to maintain. Almost nobody does pure whitelist. Behavioral analysis and ML: Modern WAFs detect anomalies. "This IP usually does 10 req/min, now 1000" → action. Black box, hard to debug. 2.3 OWASP Top 10 — what WAF really protects Good protection: Basic/medium SQL injection Basic reflected/stored XSS Path traversal Webshell upload Known exploits with signatures Gross brute force Scrapers and scanners Partial protection: Broken access control (logic) Insecure deserialization Sophisticated XSS with encoding SSRF XXE Does not protect: Business logic (negative price, race condition) Account takeover via valid credentials User phishing Insider threats WAF is a defense layer, not the defense. It buys time, blocks noise, protects against common attacks. Doesn't replace a secure application. Part 3: Why CDN and WAF appear together Same architectural position — both need to be in front Performance — inspecting HTTP at the PoP is faster Data synergy — collective intelligence among customers Volumetric DDoS only mitigates at scale — CDNs already have the network Business model — CDNs sell WAF as upsell Operational simplification — one solution instead of three In 2026, "I'm going to put a CDN" generally means "I'm going to put CDN + WAF + DDoS + bot management + rate limiting". The lines blurred. Part 4: The main CDN providers 4.1 Cloudflare The default choice. PoPs in 300+ cities, generous free plan. Strengths: Robust free plan (CDN + DNS + DDoS + SSL) Exceptional global performance Huge ecosystem (Workers, R2, D1, Stream) Cloudflare Tunnel (hides origin completely) Authenticated Origin Pulls (mTLS with origin) Cloudflare Access (ZTNA) integrated Weaknesses: Advanced WAF only in paid plans Enterprise is expensive Concerning centralization Plans: Free — CDN, DNS, SSL, basic DDoS Pro ($25/month) — managed WAF, image optimization Business ($250/month) — full WAF, cust…