WAF vs CDN security: what each actually protects

Two tools, two jobs

“CDN” and “WAF” get bundled into the same pitch so often that people assume they are the same layer of defence. They are not. A content delivery network exists to make your site fast and available — it caches static assets close to visitors and absorbs raw traffic volume. A web application firewall exists to make your site safe — it inspects the meaning of each request and decides whether it is an attack. You can run one without the other, and knowing which problem you actually have saves you from buying the wrong tool.

What a CDN protects

A CDN’s security value is mostly about capacity and reach:

• Volumetric absorption. Hundreds of points of presence spread a traffic spike — or a crude flood — across a wide surface so no single origin gets crushed.
• Cache offload. Serving cached copies means fewer requests reach your origin at all, which incidentally blunts some abuse.
• TLS termination and geographic latency. Closer edges mean faster handshakes.

What a CDN does not do well is understand the request. A cached response does nothing to stop an SQL injection aimed at your login form, because that request is dynamic, unique, and has to reach the application to matter.

What a WAF protects

A WAF works at the application layer — it reads the request the way your app would:

• Injection and scripting attacks. Both of our signature WAF engines (one in an in-process WASM sandbox and one native) run the OWASP Core Rule Set, the maintained baseline for SQL injection, cross-site scripting, and remote code execution.
• Automated abuse. A graduated challenge ladder — proof-of-work, then CAPTCHA, then Web Bot Auth (cryptographic HTTP message signatures) — separates real humans and verified bots from scripted attackers without a blanket block.
• Adaptive risk. ML entity-scoring graduates through detection → verify → enforce, so a new signal proves itself before it is ever allowed to block a request.
• Cheap flood shedding. Traffic confirmed malicious is dropped in the kernel via nftables before it reaches the WAF logic at all.

Every decision lands in an immutable, append-only audit log, so you can see what was blocked, when, and why.

Where Smart WAF sits

Smart WAF is the second tool, not the first. You point your domain’s DNS at our EU edge nodes (Hetzner, OVH, Scaleway); requests are filtered and forwarded to your origin, with EU data residency as an architectural default. We are deliberately not a global CDN — if worldwide static caching is your primary need, a CDN is the right buy and we will say so.

Our added-latency target is a ≤5 ms design budget; we label any measured figure as staging-measured until production hardware earns a firmer number. If application-layer protection for a EU-hosted site is the gap you are closing, tell us your domain.