Do I need a WAF?
Probably yes if you're on a cloud provider that bundles one (Cloudflare, Vercel, AWS, Fastly). Enable it. A WAF is a cheap layer that blocks known-bad traffic patterns. Don't rely on it as your only defense, but don't skip it either.
A Web Application Firewall filters incoming HTTP traffic against patterns that match known attacks — SQL injection, XSS, specific CVE exploitation, bot scraping.
When a WAF is worth the cost: - You're on Cloudflare (free tier includes managed rules) - You're on Vercel Pro+ (includes attack challenge mode) - You're getting high-volume automated traffic
When it might not matter much: - You're on Vercel Hobby + getting ~100 users/day - You have excellent application-layer security already
Don't treat a WAF as a substitute for: - Secure coding practices - Dependency updates - Pre-deploy scanning
A WAF blocks ~70-80% of automated attacks but misses sophisticated targeted attacks. It's a layer, not the answer.
Cloudflare's free managed ruleset is a no-brainer default for any public-facing site. Set it up, then forget it.