FortiWeb and Web Application Firewall (WAF) | Securevalley

July 2, 2026 · Nouh Droussi · Fortinet · Maroc · 4 min read · Updated September 26, 2026

The FortiWeb WAF protects your web applications and APIs at Layer 7. Features, deployment modes and the 2026 status of the cloud offering.

FortiWeb is Fortinet's web application firewall (WAF). Placed in front of your web servers and APIs, it inspects HTTP and HTTPS traffic to block injections, cross-site scripting, API abuse and malicious bots, which a network firewall is unable to interpret. It is available as a hardware appliance, as a virtual machine, on public clouds and as a container; the SaaS version is now part of FortiAppSec Cloud.

Why a network firewall is not enough

A next-generation firewall filters traffic flows, identifies applications and can apply intrusion prevention. However, an SQL injection request arrives on port 443, toward a legitimate server, within a perfectly valid session. Detecting it requires an understanding of the application logic: the expected parameters, their format, the sequence of pages and the normal behavior of a user. This is the role of the WAF, which operates at Layer 7 and understands the structure of HTTP requests.

What FortiWeb protects

• Common application attacks, in particular those listed in the OWASP Top 10: injections, broken access control, security misconfigurations, and so on.
• APIs: automatic discovery of endpoints based on observed traffic, and enforcement of positive security models based on OpenAPI, JSON or XML schemas.
• Bots: distinguishing legitimate bots (search engines) from malicious bots (data scraping, credential stuffing), using deception techniques, behavioral analysis and machine learning.
• Application-layer denial-of-service attacks and account takeover.

FortiWeb relies on two-layer machine learning detection: a first model learns the normal behavior of the application, and a second model qualifies anomalies in order to reduce false positives.

Deployment modes

The way the WAF is inserted into the network determines which features are available:

• reverse proxy: FortiWeb terminates client connections and opens new ones toward the servers; this is the most complete mode (TLS decryption, rewriting, load balancing);
• transparent proxy and transparent inspection: the WAF is inserted without changing the existing IP addressing, at the cost of some features;
• offline protection: FortiWeb analyzes a copy of the traffic but cannot block it inline; this is useful during an observation phase.

In all cases, inspecting encrypted traffic requires the WAF to have access to the certificates or to terminate the TLS session itself.

Product status in 2026: FortiWeb and FortiAppSec Cloud

FortiWeb remains an active product, with a documented 8.0 branch. However, the FortiWeb Cloud SaaS offering no longer exists under that name: it has been integrated into FortiAppSec Cloud, a platform that brings together the former FortiWeb Cloud (WAF and threat analytics), FortiGSLB (global server load balancing) and FortiGuard advanced bot protection. According to Fortinet documentation, most features remained the same through this consolidation. If you are reading older procedures that refer to FortiWeb Cloud, look for their equivalent in FortiAppSec Cloud.

Implementation method

A poorly tuned WAF either blocks legitimate users or lets attacks through. A gradual approach limits these risks:

• inventory the exposed applications and APIs, along with their technologies and their owners;
• start in detection or learning mode, analyze the logs and fine-tune the exceptions;
• switch to blocking mode one application at a time, starting with the most reliable signatures;
• integrate the WAF into the development lifecycle: each new version of an API must update its schema and therefore the associated policy;
• centralize logs in your SIEM to correlate web attacks with other events.

A WAF does not replace secure development or penetration testing: it reduces exposure, particularly during the time it takes for an application fix to be deployed.

Skills and training

Configuring a WAF requires understanding the attacks it is meant to block and being able to read a suspicious HTTP request. These learning paths complement each other:

• Certified Ethical Hacker (CEH v13) to learn the techniques used to attack web applications;
• OSCP+ for in-depth, hands-on exploitation practice, useful for testing how effective your rules really are;
• CompTIA Security+ for the fundamentals of application and network security.

Conclusion

FortiWeb protects the application layer that network firewalls cannot see, from the web form to the API. Keep in mind that the SaaS version is now called FortiAppSec Cloud, and that the effectiveness of a WAF depends above all on a gradual rollout into production and on continuous tuning.