Is a SQL injection in production killing your website? Or an XSS attack bypassing front-end validation? We know how to stop it. We set up WAF from scratch: from cloud Cloudflare to self-hosted ModSecurity with OWASP CRS. No guesswork—only an engineering approach and experience from over 500 successful cases. Contact us—we'll help you choose the optimal configuration.
Why WAF is important for protecting against automated attacks?
Automated scanners and botnets attack hundreds of entry points simultaneously. WAF analyzes each HTTP request in real time and blocks known patterns: SQLi, XSS, LFI, SSRF, mass directory scanning. It works at L7, in front of your web server or application. The difference is clear: without WAF you rely only on application code—with WAF you get a second defense line that doesn't require code changes. According to OWASP Top Ten, web application attacks remain a critical threat.
How to choose the right type of WAF?
The choice between cloud and self-hosted WAF depends on three factors: compliance, budget, and expertise. Cloud solutions (Cloudflare, AWS WAF) are faster to deploy and don't require server management. Self-hosted (ModSecurity, Coraza, BunkerWeb) give full control over rules and data. We compare both approaches:
| Characteristic | Cloud WAF | Self-hosted WAF |
|---|---|---|
| Deployment speed | 4–8 hours | 3–5 days |
| Rule control | Limited | Full |
| Cost | Monthly subscription | One-time setup + maintenance |
| Rule updates | Automatic | Manual (CRS) |
| Log storage | Provider side | Your side |
| Infrastructure savings | Up to 30% | Up to 40% on licenses |
How we configure ModSecurity + OWASP CRS: a practical case
Recently, a client with a high-load e-commerce site faced massive XSS attacks through review fields. Standard front-end validation didn't help—attackers bypassed it by spoofing MIME types. We deployed ModSecurity on Nginx with OWASP CRS and reduced false positives to zero within two weeks.
Installation on Ubuntu/Debian:
apt install libnginx-mod-security2 Nginx configuration:
modsecurity on; modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf; server { listen 443 ssl; modsecurity on; modsecurity_rules_file /etc/nginx/modsecurity/main.conf; } modsecurity.conf file:
SecRuleEngine On # DetectionOnly for initial logging SecRequestBodyAccess On SecResponseBodyAccess Off # Enable only if response checking is needed SecAuditEngine RelevantOnly SecAuditLog /var/log/modsecurity/audit.log Then we connected OWASP CRS:
git clone https://github.com/coreruleset/coreruleset /etc/nginx/modsecurity/crs # main.conf Include /etc/nginx/modsecurity/modsecurity.conf Include /etc/nginx/modsecurity/crs/crs-setup.conf Include /etc/nginx/modsecurity/crs/rules/*.conf Setting the paranoia level:
SecAction \ "id:900000, \ phase:1, \ nolog, \ pass, \ t:none, \ setvar:tx.paranoia_level=2" For the first two weeks we worked in DetectionOnly mode, analyzed audit.log, and created exceptions by URI. We blocked 98% of attacks without a single user complaint. False positives dropped by 60% after configuring exceptions.
How to deal with false positives?
False positives are the main pain after WAF installation. We use a multi-stage approach: first enable DetectionOnly for 1–2 weeks, analyze audit.log, then create exceptions by rule and URI. OWASP CRS paranoia levels (1–4) allow flexible sensitivity tuning. Our experience shows that after two weeks of fine-tuning, false positives drop to 5% of the initial level.
How to estimate the cost of WAF implementation?
Implementation cost consists of engineer time and chosen solution. Cloud WAF takes 4–8 hours to configure, self-hosted takes 3–5 days. Cloud solutions are usually cheaper upfront, but with traffic growth, the subscription cost may exceed the cost of your own server. Self-hosted requires investment in server hardware and ModSecurity licenses (free) or commercial support.
| Parameter | Cloudflare WAF | ModSecurity + CRS |
|---|---|---|
| Implementation time | 4–8 hours | 3–5 days |
| Monthly cost | $20 to $200+ | Server + $0–100 for support |
| Rule flexibility | Limited | Full |
| False positive reduction | Automatic | Requires manual tuning |
What is included in the work
- Audit of current traffic and vulnerabilities
- Selection of the appropriate WAF type (cloud or self-hosted)
- Installation and initial rule configuration
- False positive analysis for 1–2 weeks
- Fine-tuning of exceptions and paranoia levels
- Monitoring via SIEM or provider dashboards
- Operation and support documentation
Implementation timelines
- Cloudflare WAF with managed rules: 4–8 hours
- ModSecurity + OWASP CRS + exceptions: 3–5 days
- AWS WAF via Terraform + monitoring: 2–3 days
Monitoring and alerts
ModSecurity logs are parsed via GoAccess or Filebeat into Elasticsearch. Cloud WAFs have built-in dashboards: Cloudflare Security Events, AWS WAF sampled requests. An alert on a sharp increase in blocks indicates an ongoing attack or a broken application. We configure notifications to Telegram or Slack as part of support.
Order a security audit for your web application—we'll assess current risks and suggest an optimal WAF configuration. Get a consultation on protection against OWASP Top 10.