WAF Detection
Detect Web Application Firewalls protecting any website.
A Web Application Firewall (WAF) protects websites from attacks like SQL injection, XSS, and DDoS.
Common WAF/CDN providers include Cloudflare, AWS WAF, Akamai, and Sucuri.
This tool detects WAFs by analyzing HTTP headers, cookies, and server signatures.
Is there actually a firewall between your app and the internet?
WAF detection shows whether a Web Application Firewall is actively in front of your domain — or whether your application is exposed to the raw internet.
Many teams deploy a WAF through their CDN setup (CloudFlare, Fastly, AWS CloudFront) and assume it's blocking attacks. This tool sends a probing request and analyzes response headers, fingerprints, and behavioral signals to confirm whether a WAF is actually intercepting traffic — not just theoretically configured. If no WAF is detected on a production app handling user data, that's a risk worth addressing.
What WAF fingerprinting actually reveals
WAF fingerprinting analyzes HTTP response headers, error page patterns, and rate-limiting behavior to identify the specific firewall product.
Different WAFs leave different signatures. CloudFlare adds CF-RAY headers. Imperva returns specific X-Iinfo patterns. AWS WAF produces characteristic 403 error responses. Sucuri injects its own headers. By analyzing these signals together, the detection identifies not just whether a WAF is present but which product — and often which mode it's running in.
CloudFlare, Imperva, Sucuri, AWS WAF — common WAFs detected
The most common WAF providers in production deployments, each with distinctive detection signatures.
CloudFlare is the most widely deployed, detected via CF-RAY headers and ASN ownership. Imperva (formerly Incapsula) is common in enterprise environments with GDPR and PCI-DSS compliance requirements. AWS WAF is frequently paired with CloudFront distributions and ALBs. Sucuri is common on WordPress sites and content-heavy platforms. Detection covers all major commercial WAF products plus open-source options like ModSecurity.
No WAF detected: what that actually means
No WAF doesn't necessarily mean unprotected — it means no WAF fingerprint was found. Cloud hosting and network-level firewalls won't be detected by this method.
If no WAF is detected, your application may still have server-level firewalls (iptables, UFW), cloud security groups (AWS SG, GCP VPC rules), or your hosting provider's built-in protection. What this result tells you is that there's no application-layer WAF actively inspecting and filtering HTTP/S traffic before it reaches your web server. For public-facing apps processing sensitive data or user input, an application-layer WAF is strongly recommended.