Do I need a WAF for my Windows web server?
Open the access log of any web server on the internet and you will see it: requests for /.env, /wp-login.php, /.git/config, from addresses you have never heard of. Is your website under attack, and do you need a web application firewall (WAF) to stop it? It depends on what you run.
- A WAF reads every HTTP request and blocks the ones that look like attacks on your application, such as SQL injection or cross-site scripting (XSS).
- Most traffic in your log is automated: scanners looking for forgotten files, bad bots, password guessing and connection floods. You don't need a full WAF to stop that.
- SQL injection is fixed in the code (parameterised queries). A WAF is a second line of defence for it, not a replacement.
- IIS has built-in tools: Request Filtering, IP and Domain Restrictions and Dynamic IP Restrictions.
1. What a web application firewall does
A normal firewall decides by address and port: may 203.0.113.5 connect to port 443? A web application firewall looks inside the request: the URL, the parameters, the headers, the body. It compares them with rules for known attacks and blocks the request before your application sees it. Typical rules catch:
- SQL injection:
' OR 1=1 --and similar text in a form field or URL parameter; - Cross-site scripting (XSS):
<script>and other code smuggled into input that is later shown to other visitors; - Path traversal and probing:
../,/etc/passwd, requests for configuration files; - known exploits for popular software, often as a managed rule set that the vendor keeps up to date.
WAFs come in two forms. Cloud WAFs sit in front of your Server, and all traffic goes through them first: for example Cloudflare, AWS WAF or Azure Web Application Firewall. Software WAFs run on or next to the web server, for example ModSecurity with the OWASP Core Rule Set.
A WAF needs care: rules that are too strict block real customers (a search for O'Brien can look like SQL injection), and rules that are too loose let attacks through. Plan time for tuning.
2. Who really knocks on your web server
On a typical small company website, very few requests are clever attacks on your own code. Most are automated:
| What you see in the log | What it is |
|---|---|
GET /.env, /.git/config, /backup.zip → 404 | Scanners looking for forgotten files with passwords in them. |
GET /wp-login.php, /phpmyadmin/ → 404 | Bots checking for software you may not even run. |
Many POST /login → 401 or 403 from one address | Password guessing or credential stuffing (trying user name / password pairs leaked from other sites). |
| Hundreds of connections a minute from one address | A connection flood or an aggressive bad bot. |
${jndi:ldap://...} in a header | Mass scanning for the Log4Shell vulnerability, whether you run Java or not. |
The pattern is the same every time: one address, many errors, in a short time. That can be stopped by blocking the address, without inspecting every request.
3. What Windows and IIS can do by themselves
- Request Filtering (built into IIS): deny URL sequences such as
.., file extensions, hidden segments such asbinor.git, HTTP verbs, and over-long URLs or query strings. Good for closing doors you never want open. - IP and Domain Restrictions (IIS role service, install it in Server Manager): IIS block IP by single address or range. Fine for a few known attackers; nobody keeps such a list current by hand.
- Dynamic IP Restrictions (part of IP and Domain Restrictions since IIS 8): deny an address that opens too many concurrent requests or too many requests in a time window. Useful against floods, but it does not look at errors or attack patterns.
- Windows Defender Firewall: block an address for the whole Server, not only for the website. Again by hand.
- Keep the software up to date and remove what you don't use: old test sites, admin tools, sample files.
And the most important one is not a tool: clean code. Parameterised queries (prepared statements) stop SQL injection where it starts; output encoding stops XSS. If you build or buy a web application that takes input from the public, ask for this.
4. So, do you need a WAF?
- Probably yes if you run your own web application with logins, forms, a shop or customer data, and you cannot be sure the code is clean, or you must show a regulator an extra layer.
- Probably not first for a company website, a static site, an Exchange / OWA front end or a small intranet published to the internet. Here the risk is mostly the automated traffic from section 2, and blocking those addresses brings the most for the least effort.
- Either way: a WAF does not replace up-to-date software and clean code, and it does not protect the other doors of the Server (RDP, SQL, mail, SSH).
5. The affordable extra layer: Coinetic bans the bots for you
Coinetic is not a WAF. It does not inspect form fields and will not catch a single, well-made SQL injection. What it does is stop the automated traffic that fills your log, by banning the address in the Windows Firewall.
Doing this by hand means: reading IIS, nginx, Apache or Caddy logs every day, spotting the scanners, adding their addresses to an IP restriction or firewall rule, and starting again tomorrow, because the bots come from new addresses all the time. A full WAF takes setup, tuning and, for cloud WAFs, moving your traffic through someone else's network. Neither tells you about attacks on RDP, SQL Server or mail on the same Server.
Coinetic does this by itself on Windows Servers and PCs with a web server (web server protection is in the Pro plan):
- Finds your web server on its own: IIS, Caddy, nginx and Apache, with their access logs. No log paths to type in.
- Scanners are banned at once: an address asking for
/.env,/.git/,../,${jndi:or/etc/passwdis banned after that one request. - Bad bots and password guessers are banned at your limit: an address that causes too many errors (400, 401, 403, 404) in a few minutes is banned in the Windows Firewall, so it cannot even connect again.
- Floods too: an address opening too many connections per minute to any open port is banned.
- Your visitors are safe: Cloudflare's addresses are never banned, and your own network and whitelisted addresses are shown but never banned.
- You can look at any time: the Web Server page in Coinetic shows the scanners, bots and floods as they happen, and its header proves the log is really read (“N requests read, last 5 s ago”). It is not a one-time check.
- Your AI security analyst (Pro + AI): right-click any line, ban, port or connection and choose Ask AI, e.g. “Who is hammering my web server, and did anything get through?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.
The same Coinetic also watches the other doors of the Server: failed logins on RDP, VPN, SQL Server, mail, SSH, VNC and FTP. And an admin port you don't need open to everyone, such as RDP: Coinetic closes it, or makes it invisible forever or until you unlock it from your phone (how that works).
Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.
More guides: all Coinetic guides.
Frequently asked
Does Coinetic replace a WAF?
No. A WAF looks inside each request; Coinetic bans addresses that behave like scanners, bots or floods. Many sites need only the second. If you need both, they work well together: the WAF filters requests, Coinetic keeps the noisy addresses off the Server.
My site is behind Cloudflare. Will my visitors be banned?
No, Cloudflare's addresses are never banned. Configure the web server to log the real visitor address (the CF-Connecting-IP header). Note that a Windows Firewall ban stops direct connections to the Server, not traffic that comes through the proxy; for that, use the proxy's own rules.
Does it stop credential stuffing?
When your login answers a wrong password with an error status (401 or 403), the repeated failures count and the address is banned at your limit. If your application answers with a normal page (200), the log does not show a failure; then rate limits or a lockout in the application itself are needed.
How do I block an IP address in IIS?
Install the IP and Domain Restrictions role service, then open the site in IIS Manager › IP Address and Domain Restrictions › Add Deny Entry. To block an address for the whole Server, add it to an inbound block rule in Windows Defender Firewall instead.