There are two main types of web application firewalls. Network-based WAFs watch and filter traffic between the app and the internet. Host-based WAFs sit on the web server, protecting at the application layer.