WAF detector: find out which firewall protects a website
Identify the web application firewall in front of a website and its vendor, for free, with a Website Recon scan. Discovers up to 100 different WAF products.
Quick update: In October 2026, we folded the standalone WAF Detector into Website Recon, so WAF detection now runs automatically in every Website Recon scan, including the free one. Our Website Scanner also reports a dedicated WAF detection finding for deeper, active testing.
Detect a website’s WAF for free
On Oct 20, 2026, we consolidated WAF Detector into the free Website Recon. Use it to discover a website’s technologies, both server-side and client-side.
Identify the web application firewall in front of a website and its vendor, for free, with a Website Recon scan. Discovers up to 100 different WAF products.
Quick update: In October 2026, we folded the standalone WAF Detector into Website Recon, so WAF detection now runs automatically in every Website Recon scan, including the free one. Our Website Scanner also reports a dedicated WAF detection finding for deeper, active testing.
How does WAF detection work?
A web application firewall (WAF) sits between a website and its visitors and filters requests that look like attacks. To find out whether a WAF is there, and which one, a detector sends requests that resemble common attacks, such as cross-site scripting and SQL injection, and studies how the site answers.
Each WAF reacts in its own way: a specific block page, a status code, a header, or a cookie. Matching those reactions against known WAF signatures reveals the firewall and its vendor.
Knowing the WAF matters on both sides of a test. Pentesters use it to plan payloads and to understand why a request got blocked. Defenders use it to confirm that the firewall they pay for actually sits in front of every site they think it protects.
Why WAF security matters: a firewall that became the way in
In 2019, an intruder accessed data on more than 100 million Capital One customers. The intrusion started with a misconfigured open-source web application firewall in the company's AWS environment, which the attacker tricked into relaying requests to back-end resources it should never have reached (KrebsOnSecurity).
A WAF is software with its own configuration, permissions, and attack surface. Knowing it's there is where the work starts, not where it ends: the app behind it still needs testing, and the firewall itself needs the same scrutiny as any other internet-facing system.
How to detect a WAF
For a quick, free check: Website Recon
- Enter the website's URL into our free Website Recon.
- Run the scan. WAF detection runs automatically, alongside technology fingerprinting, and follows redirects on its own.
- Check the results for the WAF name and vendor, next to the server-side and client-side technologies the site uses.
For additional passive WAF testing: Website Scanner
If you specifically want to test a WAF, use the WAF detection finding in our Website Scanner. It runs as its own scan option and tests the firewall more thoroughly than the quick check.
- Add the website as a Website Scanner target.
- Select the WAF detection option and run the scan.
- Schedule the scan to repeat, so you notice when a WAF changes or disappears from a site.
Is WAF detection safe to run?
WAF detection works by sending requests that look like attacks, so the firewall has something to react to. Website Recon and the Website Scanner both send these payloads.
The payloads don't exploit the website, but the WAF will likely treat them as attacks, so expect three things:
Log entries: your WAF and web server will record the requests as attack attempts.
Alerts: your security team or your WAF provider may get notified.
Blocks: the WAF may block the scanning IP address for a while, which can affect other scans you run from the same account.
Tell your security team or WAF provider before you scan a site they monitor, and scan only websites you're authorized to test.
If you used the WAF Detector
We're automatically migrating your scheduled WAF Detector scans to Website Recon in November 2026. Your past reports stay in your account.
If you used the WAF Detector to test firewalls also passively, move those targets to the Website Scanner, which runs the dedicated WAF detection. API users can run WAF detection through the Website Scanner and Website Recon API, since the WAF Detector has left the API.
Since these are different tools, their findings don't connect. Scan and finding comparisons won't link your new results to your old WAF Detector reports.
WAF Detector FAQs
Can I detect a WAF for free?
Yes. WAF detection runs automatically in every Website Recon scan, including the free version. For additional WAF passive testing with the Website Scanner, you need a paid plan.
How many WAFs can it identify?
It can detect 97 different WAF products.
Does it still find the origin IP behind the WAF?
Yes.
Will the scan trigger my WAF?
Very likely. It's designed to. See the safety section above for what to expect and how to prepare.
Can I detect WAFs through the API?
Yes, through the Website Scanner or Website Recon in our API. The standalone WAF Detector is no longer available there.
Where are my old WAF Detector reports?
In your account, under your past scans.
Test the app behind the WAF
A WAF filters known attack patterns. It doesn't fix the vulnerabilities in the app behind it, and attackers spend their time looking for requests the firewall lets through.
Our Website Scanner tests the app itself for issues such as SQL injection and cross-site scripting, so you know what's exposed if the firewall misses a request or someone reaches the app another way.
It's part of our Continuous scanning & validation product: continuous web, network, and cloud scanning with 17,400+ detections and exploit modules, safe exploitation where supported, and evidence captured with each finding.