A WAF is usually placed close to the internet-facing applications. In most application architectures, a WAF is typically positioned behind the load-balancing tier to maximize utilization, reliability, performance, and visibility.