Web Application Firewall

A firewall inside your app. No proxy, no infra ticket.

The ApiTraffic WAF runs as middleware, after your body parser and before your routes - so it inspects the parsed request your handler is about to see and stops the bad ones there. Policies are built in ApiTraffic and pushed to every server running your app, with no redeploy.

Start your free trial See pricing

Firewall overview in enforcing mode: matched and blocked requests, rule hits, anomaly scores, and matching and enforcement over time

How it works

Monitor first. Enforce with evidence.

Every policy can run in monitor mode: requests are inspected and recorded, never refused, so you see precisely what enforcing would have done before you turn it on.

Turn it on

Built into @apitraffic/node. With a per-framework package, it is one middleware line before your routes.

app.use(waf.express())

Monitor

Requests are evaluated and recorded with the rule, field and score - never rejected.

Mode: Monitor

Enforce

Exclude the handful of false positives you found, then switch the policy to enforcing.

Mode: Enforcing

Capabilities

Protection a small team can actually run

More than half of web traffic is automated, and a growing share of it is aimed at APIs. Source: Imperva 2026 Bad Bot Report

Managed OWASP rules

SQL injection, XSS, RCE, path traversal, SSRF, SSTI, NoSQL injection, XXE and scanner signatures, with anomaly scoring and a sensitivity you choose.

Rate limits and access lists

Allow or deny IPs, ranges and countries, rate-limit per caller, and write custom rules against any part of the parsed request.

Behavioral protection

Catches what no single request shows: a caller walking object ids, collecting 401s, probing for endpoints or moving at machine speed - and denies it everywhere.

Outbound and AI protection

Inspect the calls your app makes - prompts to a model, tool calls, third-party APIs - and refuse the ones carrying credentials or bulk personal data.

Test before it goes live

Replay up to 250 recent requests against an edited policy, unsaved changes included, and see exactly what it would block. Nothing is blocked or saved.

Your own block responses

Write the status, content type and body a blocked caller receives - with a reference to find the blocked request - and reuse it across policies.

One record

Blocked requests are still requests

A blocked request appears in your traffic like any other, with the firewall’s decision attached: the decisive rule, the anomaly score, the field it matched and the policy that ran. Security and engineering look at the same screen during an incident.

Filter by decision and review every match in one place
Block it, or stop a rule flagging it, straight from the request
Alerts and dashboards flag a burst of blocks the moment it starts

WAF tab on a blocked request: the decisive rule AT-SCAN-001, anomaly score 5 of 5, the policy in enforcing mode and the matched rule with its category, severity and target

Versus edge WAFs

An edge WAF sees a request. Yours sees the request your code sees.

That difference decides whether an injection attempt buried in a JSON body, behind a CDN and a gzip layer, gets caught.

	Edge / proxy WAF	ApiTraffic WAF
Deployment	Infrastructure change, DNS or gateway config	Built into the SDK, or one middleware line
What it inspects	Raw HTTP as it arrives at the edge	Parsed body, params and headers your handler receives
Added network hops	At least one	None - in-process
Outbound calls	Not seen	Prompts, tool calls and third-party requests inspected
Explaining a block	Log line, if you have access	Rule, field, score and policy on the request
Rollout safety	Often all-or-nothing	Monitor mode and replay testing first
Correlated with traffic data	Separate product	Same request record, same UI

The in-app WAF complements edge protection rather than replacing volumetric DDoS mitigation, which still belongs in front of your infrastructure.

Install

Protected before your coffee gets cold

With @apitraffic/node the firewall is already in your app - switch on a policy and it starts inspecting. With a per-framework package, mount the WAF after ApiTraffic and after body parsing, so it sees parsed request data and refuses blocked traffic before your routes run.

// The firewall is built in. Turn on a policy in ApiTraffic -
// there is nothing to install and no code to change.
app.use(apitraffic.express());

Run it in monitor mode this week. Decide with data.

Turn on a policy, watch a week of real traffic, and see exactly what enforcing would have stopped before you flip it.

Start your free trial

Free trial · No credit card · Set up in minutes