Web Application and API Protection (WAAP)
Core concepts
WAAP is the umbrella: WAF, API security, bot mitigation, DDoS, and often client-side protection, delivered consistently across edge and origin. Understand the OWASP Top 10 categories a WAF targets - injection, broken access control, misconfiguration, SSRF, and so on - and that the WAF addresses classes of attacks, not every instance of a vulnerability.
Key building blocks: hostname and path-based configuration, security policies attached to properties, match targets (path, method, headers, query), and rule sets (managed + custom). Understand TLS/transport basics and origin shielding as part of a defense-in-depth posture. Learn the difference between edge enforcement (block before origin) and origin-side controls, and how configuration versioning/activation works - changes are staged, then activated across the network.
Traps to watch
- Believing a WAF replaces secure coding - it mitigates, it does not fix logic flaws like broken access control.
- Confusing match target (where a rule applies) with rule action (what happens).
- Assuming a policy change is instant everywhere - activation propagates across the platform.
- Overlooking that API endpoints need their own policy/definitions, not just web paths.
Rule of thumb
Think in layers: DDoS at the network edge, WAF/bot at the application edge, positive API validation, and origin hardening. Each layer catches what the previous misses.
Worked example: A new admin path must be protected. You define a match target scoping the path, attach managed and custom rules, stage the change, then activate - verifying enforcement before relying on it.