If you’re wondering how a WAF works, let’s look at it from a high level. Before visitors reach your website, they pass through the WAF to determine if they’re legitimate traffic — and get blocked if they meet the definition of a bad actor or scam. On a more granular level, there are a number of different components that allow a firewall to detect and block malicious traffic to prevent it from attacking your website: application profiling, blocklist signatures, correlation engine, DDoS protection, and CDN.