What a WAF is and how it differs from bot protection
Contents
Share
A WAF is an application firewall for HTTP. It applies a rule set to the HTTP conversation and usually covers common attacks such as cross-site scripting and SQL injection. Bot protection looks at automatic requests and leaves the reaction to the owner. One edge filter does not replace both contours.
Neither a WAF nor bot products by themselves subtract click fraud from an ad account. If you are choosing a box "in front of the site," decide first which conversation it inspects.
A rule set in front of the application
In the OWASP community wording, proxies protect clients, while a WAF protects servers and sits in front of a particular application or a group of applications. It can be thought of as a reverse proxy. Fitting rules to the application can be a large job, and it has to be kept up as the application changes.
The text was moved from an old wiki and warns that it is still being put in order. Bots, scraping, and ad clicks are outside this definition. A rule looks at the conversation: what arrived in the request and whether it looks like a known attack on the application. An automatic but ordinary-looking browse of a catalog is not among the examples.
Where Cloudflare's documentation sends bots
The Cloudflare WAF overview describes its product this way: the WAF inspects incoming requests to the site and API and filters unwanted traffic with rule sets — address, path, headers, body. The capability table includes leaked-credential detection on every plan. The overview does not name the database the check runs against. Its last sentence sends bots to separate bot solutions.
The bot solutions overview says bots — automatic programs that send requests to a site — can take content, try stolen passwords on login forms, buy up stock, and inflate server cost. Bot products detect that automatic traffic and leave the reaction to the owner. Both pages talk about Cloudflare products. They do not say that a WAF or a bot product subtracts clicks in an ad account. Invalid clicks stay the platform's decision. Click fraud and sklikivanie are not closed by these overviews.
Three bot products, and none of them is the ad account
Cloudflare's documentation splits bot products in three. This is Cloudflare's scale, not a Direct filter and not Binetro's check.
Bot Fight Mode on the free plan meets detected bots with a computation challenge across the whole domain, from one switch, with no rules of its own and no bypass through Skip in WAF rules. Super Bot Fight Mode on Pro, Business, and Enterprise, without the separate Bot Management add-on, gives actions by category and exclusions by WAF rules, but not a per-request score. Bot Management for Enterprise gives a score per request and its own rules.
On the Free, Pro, and Business scenarios, a score of 1 means the request is almost certainly automatic, scores 2–29 mean probably automatic, and the documentation asks you not to challenge or block scores 30–99 as a human. Score-distribution analytics start on the Business plan. The same pages say Bot Fight Mode and Super Bot Fight Mode are aggressive by design and false positives are expected, especially in the first days. Rule expressions and rate thresholds are not carried into this walkthrough. The public overviews do not say the product removes invalid clicks in Direct or Google Ads.
Who clicks ads and why is not described by Cloudflare scores. Whether Yandex refunds click fraud does not depend on Bot Fight Mode.
Why one box is not enough
OWASP's guidance places a CDN, a WAF, and an anti-bot service in one edge layer. Next to it, it requires an application layer and a business-rules layer. Among the antipatterns it says separately that relying on a single edge "box" is fragile: when it is configured wrong, the whole site suffers or is left open.
| Layer | What it inspects | What it does not do |
|---|---|---|
| WAF in the OWASP wording | The HTTP conversation; XSS and SQL injection in the examples | Bots, scraping, ad clicks |
| Cloudflare WAF | Address, path, headers, body; leaked credentials | Does not replace bot solutions |
| Bot Fight / Super Bot Fight / Bot Management | Automatic requests, differently on different plans | Does not subtract clicks in Direct or Google Ads |
| Application and business-rules layers | What the edge box does not see as a protocol attack | Does not appear by itself if only a WAF is left |
For a site the order is simple. First decide whether you are closing attacks on the application (injection, scripting) or automatic visits (taking content, trying passwords, buying up stock). The first is WAF work. The second is placed in bot products in Cloudflare's documentation, and even those leave the reaction to the owner. An ad click is not written off by either overview. Keep the edge filter up as the application changes, and do not leave it as the only layer.