A web application firewall (WAF) is a security appliance or software that filters and monitors HTTP and web application traffic. It helps protect web applications from attacks, such as SQL injection, cross-site scripting, or unauthorized access attempts.