WAF and CDN: When It Makes Sense, Which Ones Exist, How to Choose An honest guide to the two most misunderstood technologies in web security — and why so many companies use them wrong, overspend, or remain unprotected even with both in place.
An honest guide to the two most misunderstood technologies in web security — and why so many companies use them wrong, overspend, or remain unprotected even with both in place.
If you've gone through the recent posts in this series hardening web servers, configuring email authentication, protecting certificates, and closing ports, you've probably thought: "all this is great, but what if I put a CDN with WAF in front? Wouldn't that solve 80% of the problems at once?"
The honest answer is: sort of. CDN and WAF are powerful tools that solve real problems, but they're also frequently used as a magical bandage that makes everyone sleep soundly while fundamental problems remain untouched.
Worse: many people use WAF thinking they're protected when they're actually in "monitor only" mode for two years, or have rules so generic they block legitimate customers while letting real attacks through.
CDN — Content Delivery Network. The original idea from the 1990s: spread copies of content on servers around the world. By 2026, CDNs have evolved to do much more.
WAF — Web Application Firewall. Unlike traditional firewalls (layers 3-4), it operates at layer 7 — understands HTTP, knows web application semantics, decides based on content.
It intercepts every HTTP request and asks:
wp-config.php?If yes: it blocks, challenges (CAPTCHA), logs, or flags.
Negative security model (blacklist): "Everything allowed, except this." Standard for most. ModSecurity + OWASP CRS is the classic example. Works out-of-the-box, generates false positives.
Positive security model (whitelist): "Only allowed what matches this." Much safer, exhausting to maintain. Almost nobody does pure whitelist.
Behavioral analysis and ML: Modern WAFs detect anomalies. "This IP usually does 10 req/min, now 1000" → action. Black box, hard to debug.
Good protection:
Partial protection:
Does not protect:
WAF is a defense layer, not the defense. It buys time, blocks noise, protects against common attacks. Doesn't replace a secure application.
In 2026, "I'm going to put a CDN" generally means "I'm going to put CDN + WAF + DDoS + bot management + rate limiting". The lines blurred.
The default choice. PoPs in 300+ cities, generous free plan.
Strengths:
Weaknesses:
Plans:
For whom: practically everyone. Hard to go wrong.
Strengths:
Weaknesses:
For whom: those already in AWS.
The oldest. 4,000+ PoPs.
Strengths:
Weaknesses:
For whom: large companies, financial, government.
Known for speed and VCL.
Strengths:
Weaknesses:
For whom: publishers, media, high-volume e-commerce.
European alternative that grew quickly.
Strengths:
Weaknesses:
For whom: SMEs that want good, cheap CDN without complications.
Strengths:
Weaknesses:
For whom: those already in GCP.
Strengths:
Weaknesses:
For whom: Microsoft-heavy organizations.
ModSecurity — the most known. Apache/Nginx/IIS module. Combined with OWASP Core Rule Set it's the de facto standard in self-hosted. Mature (20+ years), free, complex, generates false positives.
Coraza — modern fork in Go. Faster, better integration with modern proxies (Caddy, Traefik). Compatible with ModSecurity rules. Growing trend.
NAXSI — lightweight for Nginx, whitelist. Fewer false positives, requires learning.
OpenAppSec — uses machine learning, Check Point project with community version.
| Solution | Type | Cost | Complexity | For whom | |---|---|---|---|---| | Cloudflare WAF | Cloud (CDN) | $ to $$ | Low | Practically everyone | | AWS WAF | Cloud (CDN) | $ to $$ | Medium-High | AWS users | | Akamai Kona | Cloud (CDN) | $$ | High | Enterprise | | Fastly NGWAF | Cloud (CDN) | $$ | Medium | Technical companies | | Imperva | Separate cloud | $$ | High | Enterprise | | ModSecurity + CRS | Open-source | Free | High | Self-hosted | | Coraza | Open-source | Free | Medium | Modern self-hosted | | FortiWeb | Appliance | $$ | Medium | Datacenter |
Possible but rare. ModSecurity directly in Nginx/Apache. Makes sense when compliance prohibits third parties, full control matters, low traffic, cost is critical. Disadvantage: no volumetric protection, HTTP inspection on the server itself.
Institutional site/blog: Cloudflare Free.
Small-medium e-commerce: Cloudflare Pro/Business.
Large e-commerce: Cloudflare Business/Enterprise, Fastly or Akamai.
B2B SaaS: Cloudflare Pro/Business or AWS CloudFront + WAF (if in AWS).
High-volume public API: Cloudflare Business+ or AWS WAF.
Financial/banking: Akamai, Imperva or Cloudflare Enterprise. Consider on-premise for regulated environments.
Media/publisher: Fastly or Cloudflare.
WordPress: Sucuri or Cloudflare.
Self-hosted, data sovereignty: Nginx + ModSecurity + OWASP CRS, or Coraza.
Microsoft-heavy on Azure: Azure Front Door + Azure WAF.
Multi-customer MSP: Cloudflare or AWS WAF.
You activate in log-only mode and never switch to blocking. You have all the logs in the world, zero real protection. Set a deadline: 30 days to blocking mode.
CDN in front, but attacker discovers the real IP (crt.sh, DNS history, scans) and bypasses everything. Solution: IP restriction or mTLS (Authenticated Origin Pulls).
Generic ones block legitimate traffic. Specific ones miss variations. Start with managed rules, adjust only where necessary.
You configure it and never look. Sophisticated attack passes, legitimate customer gets blocked, you only find out when they call.
"Compliance security" — install to pass PCI-DSS and think you're protected. WAF is a layer, not the only one.
Straight to prod = recipe for disaster. Always staging first, gradual rollout.
ModSecurity with outdated OWASP CRS is partially blind. Automate updates.
CDN caching page with another user's session and serving to everyone. Massive data leak. Always Cache-Control: private or no-store on sensitive content.
WAF logs separate from SIEM, alerts separate. Incidents slip through. Integration from day 1.
Free → Pro → Business → Enterprise. Model cost with projected traffic. Have billing alerts. Black Friday can generate unexpected bills.
DECISION AND PLANNING
[ ] Evaluated if you need CDN
[ ] Evaluated if you need WAF
[ ] Modeled cost with projected traffic
[ ] Compared 2-3 candidates
[ ] PoC with real traffic
CDN
[ ] DNS pointing to CDN
[ ] Origin with mTLS or IP whitelist
[ ] Cache configured correctly
[ ] Origin HTTPS enabled
[ ] Compression (Brotli/gzip)
[ ] HTTP/2 and HTTP/3
[ ] Image optimization (if applicable)
WAF
[ ] Managed rules enabled
[ ] Blocking mode (not monitor forever)
[ ] False positives adjusted
[ ] Custom rules for app patterns
[ ] Rate limiting on sensitive endpoints
[ ] Bot management active
[ ] Geo-blocking where it makes sense
OPERATION
[ ] Logs centralized in SIEM
[ ] Monitoring dashboards
[ ] Alerts for anomalies
[ ] Documented runbooks
[ ] Team trained
[ ] Emergency procedure
[ ] Periodic rule review
[ ] Automated updates
DEFENSE IN DEPTH
[ ] Origin hardening up to date
[ ] Patches applied
[ ] Application still secure (SAST/DAST)
[ ] External continuous monitoring
[ ] Independent backup
[ ] Fallback plan if CDN goes downWAF and CDN are powerful tools that solve real problems. But they're not a magical bandage. Companies that put Cloudflare in front and stop thinking about security are just as vulnerable as before — they just don't realize it.
Analogy: WAF/CDN is like hiring private security for your store. It's important, adds real value. But if the back door is open, if the safe has no lock, if employees have weak passwords — private security doesn't solve it. It's a layer. Not the only one.
The good news: CDN and WAF are more accessible than ever. Cloudflare Free protects most SMEs with minutes of configuration. Bunny.net offers excellent CDN at rock-bottom prices. ModSecurity is free and mature. There's no excuse anymore for not having at least an initial layer.
The bad news: choosing wrong, configuring wrong, or forgetting to monitor gives a false sense of security that's worse than conscious insecurity.
SentinelHub sweeps exactly this ecosystem: automatically detects which CDN/WAF is protecting your domains (Cloudflare, AWS, Akamai, Imperva, Sucuri, Fortinet, F5, and 30+ more providers), validates that the WAF is active (not just present), tests with benign payloads to confirm blocking, identifies if origin is directly exposed, monitors TLS certificates, and alerts when something changes. Because putting the CDN up is the beginning — keeping it working properly every day is the real job.