WAF Detection Check: What StackShield Tests

What this check runs

This check determines whether a Web Application Firewall sits in front of your application, in the style of wafw00f, and if so, identifies it. It sends requests designed to provoke a WAF's characteristic responses and reads whether one is present and what it appears to be.

Why it matters

A WAF is a layer of defence that inspects incoming requests and blocks obviously malicious ones before they reach your application. Knowing whether you have one, and whether it is actually active in front of your production site rather than assumed, matters to your overall posture. Many teams believe they are behind a WAF because their CDN offers one, without having confirmed it is enabled and enforcing.

There is a second reason this check is useful: attackers run the same detection. Knowing whether you present a WAF tells them how much evasion their attack will need, and the absence of one tells them the application's own code is the only thing standing in the way.

What the findings mean

The finding states whether a WAF was detected and, if so, which. No WAF is not a vulnerability, but it means every request reaches your application unfiltered, which raises the importance of every other check on this list.

The remedy, if you intend to run one, is enabling and configuring the WAF your CDN or host provides and confirming it enforces on production, then treating it as one layer rather than a substitute for fixing the underlying issues. Run a scan to see your current posture.