What Is a Cloud WAF and How Is It Different from a Network Firewall?

Primary Guard · May 12, 2026 · 5 min read

Network firewalls don't protect web applications. What a cloud WAF does, how it inspects traffic at Layer 7, and how it differs from the network firewall you already have.

Last updated: 29 October 2026

A web application firewall (WAF) is a security tool that filters traffic going to your website or app. A cloud WAF runs as a service in the vendor's network, not as a box in your office. Most companies already own a network firewall, but it does a different job. This article explains the difference, what a cloud WAF includes, and how three vendors compare.

Network firewall vs WAF

A network firewall works at layers 3 and 4 of the OSI model, the network and transport layers. It filters data packets by IP address, protocol and port, according to Fastly. A WAF works at layer 7, the application layer, and inspects HTTP and HTTPS requests. Think of the network firewall as the guard at the building door, and the WAF as the check on what each visitor carries inside.

Fastly sums it up this way: a firewall defends your network infrastructure, while a WAF defends your web application. You usually need both.

What a WAF blocks

Cloudflare says a WAF typically helps protect against SQL injection, cross-site scripting (XSS), cross-site request forgery and file inclusion. SQL injection means an attacker types database commands into a form. XSS means an attacker slips a harmful script into a web page that other visitors then load.

A WAF follows rules, also called policies, which can be changed quickly when new attack methods appear. Cloudflare also says a WAF is not designed to defend against every type of attack, so it works best as one part of a wider defence.

How a cloud WAF works

A WAF is a reverse proxy. It sits in front of your server, and visitors must pass through it before they reach your application. Cloudflare says cloud WAFs usually offer a turnkey set-up, often just a DNS change that redirects traffic to the vendor.

The vendor updates the rules against new threats for you. The trade-off, Cloudflare notes, is that you give up some control, and some features can feel like a "black box".

Cloudflare, Akamai and bunny.net compared

Cloudflare WAF has managed rules (ready-made and regularly updated), custom rules and rate limiting rules. The Free Managed Ruleset is on all plans. The Cloudflare Managed Ruleset and the OWASP Core Ruleset need Pro or higher. Cloudflare API Shield, its API security suite, is for Enterprise customers.

Akamai App & API Protector combines a WAF with layer 7 DDoS defence, API discovery and bot controls. Akamai says its adaptive protections automatically push the latest defences, including zero-day and CVE protections.

Bunny Shield is the WAF from bunny.net. Its page says it blocks zero-day exploits and OWASP Top 10 risks, with plans from a free Basic tier to Enterprise. On 29 October 2026 the paid Advanced plan was listed at US$9.5 a month, plus a request allowance. Check current prices before you decide.

What to get right

Default rules are a starting point, not a finished set-up. Akamai says WAF solutions must be constantly tuned as threats evolve and applications change. Rules that are too strict can block real customers, which is called a false positive.

Test before you block. Cloudflare's Attack Signature Detection records matches without applying an action, so you can see what a rule would catch first.

How Primary Guard helps

Primary Guard is a partner of Cloudflare, Akamai and bunny.net, and sets up and runs Cloud WAF services in Malaysia. Our Cloud WAF service covers expert onboarding, custom WAF tuning and 24/7 monitoring on Cloudflare. We can also help you compare the three vendors for your needs. For bunny.net, we handle DNS, CDN, WAF rules and testing on the bunny.net partner page. See also our Cloud WAF in Malaysia page and the CDN service.

Not sure whether your network firewall covers your web applications? Primary Guard can review your set-up with you. Contact us to start the conversation.

Frequently asked questions

Is a cloud WAF the same as a CDN?

No. A CDN caches content close to your users, while a WAF filters requests for attacks. Many vendors sell both together, but they do different jobs.

Does a WAF protect my APIs?

It can, depending on the vendor and plan. Akamai says App & API Protector addresses the OWASP API Top 10. Bunny.net says its WAF guards APIs, logins and endpoints. Cloudflare's API security suite is Enterprise only.

Do I still need a network firewall?

Yes. They work at different layers. The network firewall controls which traffic reaches your network, and the WAF checks what web requests contain.

Key takeaway

A network firewall cannot read web requests, so a WAF fills that gap. Choose a vendor and plan that fit your applications, test the rules before you block, and keep tuning them.

Sources

This article is based on vendor documentation checked on 29 October 2026. Features, plans and prices can change, so confirm details with the vendor. It is general information, not advice.