LinkedIn Tag

Can a WAF detect when malicious JavaScript is stealing user data from my website?

The answer is no, because the data theft happens within your user's browser after your WAF has done its job. Credit card information collected by malicious scripts from your checkout form is sent to the attacker's server. This outbound request comes directly from the user's browser, not from your infrastructure. Your WAF only sees everything between your users and your servers, but it's blind when it comes to data exfiltration happening in real-time.

Questions left?
Get answers from our experts