Ask a business owner if their office has a lock on the door and they’ll look at you funny. Ask if their website has a firewall and you’ll usually get a pause, then: “…I think the hosting company handles that?”
Usually, it doesn’t — at least not the kind that matters. And since we’ve written before about how website breaches actually happen (automated attacks scanning every site on the internet, no matter how small), this is the natural follow-up: the single most effective piece of protection you can add, what it costs in 2026, and which one fits your situation. Spoiler: for many SMEs the right answer is free.
What a web application firewall actually does
A web application firewall (WAF) is a bouncer standing between the internet and your website. Every request to your site — every visitor, every bot, every attack — passes it first. Legitimate traffic walks through; anything matching known attack patterns gets turned away at the door: SQL injection attempts, brute-force login attacks, DDoS floods, and exploit payloads hunting for known holes in plugins and themes.
The key phrase is before it reaches your server. Without a WAF, every attack gets to try its luck against your actual site, and your security depends entirely on nothing ever being out of date. With one, the overwhelming majority of junk never arrives at all. It’s the difference between a bouncer at the door and hoping every window in the building is locked.
One distinction worth knowing, because it explains the recommendations below: DNS-level (cloud) firewalls filter traffic out in the provider’s network before it ever touches your server — strongest protection, and they usually speed your site up too. Application-level (plugin) firewalls run inside your website itself — the attack reaches your server but gets inspected there. Cloud is the stronger front line; a plugin is a valuable second layer.
The picks for 2026
Cloudflare — the default choice, and the free tier is genuinely good.
Cloudflare is consistently rated the best fit for personal sites up to mid-sized businesses, and its free plan provides excellent protection for most sites — DNS-level filtering, DDoS protection among the best available, bot blocking, and a global CDN that makes your site faster as a side effect. The Pro plan at US$20/month adds the fuller managed WAF ruleset and is widely called the best value for growing businesses — flat-rate, so it doesn’t climb with your traffic. If you do one thing after reading this post, putting your site behind Cloudflare is it.
Wordfence — the WordPress specialist, as a second layer.
If your site runs WordPress (statistically, it probably does), Wordfence is the leading security plugin: an application-level firewall plus malware scanning and login protection, with a capable free version and a paid tier around US$79–99/year for real-time rule updates. Its limitation is the flip side of its design — being a plugin, it inspects attacks after they reach your server. Which is why the widely recommended 2026 setup for WordPress sites is Cloudflare free + Wordfence free together: cloud filtering in front, WordPress-aware inspection behind. Two layers, zero dollars.
Sucuri — the all-in-one, and the one to call if you’re already infected.
Sucuri’s cloud WAF (roughly US$10–42/month, or ~US$199/year for the full platform) works with any CMS — WordPress, Joomla, Drupal, custom builds — and bundles virtual patching, hardening, and security monitoring into one service. Its standout is what no one else on this list does as well: professional malware cleanup. If your site is already compromised, Sucuri’s remediation service scrubs the infection and gets you off Google’s blocklists. Best pick if you want one vendor handling everything, or if you’re reading this because something’s already gone wrong.
AWS WAF — for custom applications on Amazon’s cloud.
If your business runs a custom web application on AWS (rather than a CMS website), AWS WAF integrates natively — pay-as-you-go from roughly US$15/month, scaling with rules and traffic. It’s more of a developer’s tool than a set-and-forget product, so it belongs in the conversation with whoever builds and maintains your application.
(Enterprise-grade options like Imperva exist at US$400+/month — genuinely powerful, and genuinely overkill for a typical SME.)
The quick decision
- Any website, any budget: put it behind Cloudflare free today.
- WordPress: Cloudflare free + Wordfence free — the two-layer standard.
- Want one vendor for everything, or already hacked: Sucuri.
- Custom app on AWS: AWS WAF, configured by your developer.
- Growing, traffic-heavy, or e-commerce: Cloudflare Pro at US$20/month is the best-value upgrade on this list.
The honest fine print
Two things a firewall won’t do, so nobody oversells you. First, a WAF is a shield, not a substitute — it blocks attacks against vulnerabilities, but the vulnerabilities are still there. Updates, strong passwords with MFA, backups, and sensible access control (all covered in our website security checklist) still matter; the RedDoorz breach we recently wrote about, for instance, involved a leaked access key that no firewall would have caught. Second, setup quality matters: a WAF in “logging only” mode, or with your server still directly reachable around it, is security theatre. Ten minutes of correct configuration is the difference between protected and decorated.
And a note for PDPA-minded owners: under Singapore law you’re required to make reasonable security arrangements for the personal data you hold. In 2026, with capable firewalls available literally free, “we didn’t have one” is an increasingly hard position to defend — to the regulator or to your customers.
Where Oasis Web Asia comes in
Every site we build ships behind a properly configured firewall as standard — typically Cloudflare, layered and locked down correctly, with the rest of the security basics (updates, access control, backups, PDPA-aligned data handling) built in rather than bolted on. If you have an existing site and honestly don’t know what’s protecting it, we can check in minutes and set it right — usually without changing anything your visitors see. It’s part of the same evidence-first web development Singapore SMEs come to us for: unglamorous foundations, done properly, so the phone call from a stranger never comes.
If you got to the end of this post and realised your answer to “does your website have a firewall?” is still “…I think so?”, that’s exactly the conversation we like to have.
Start a conversation → — get a free consultation with our Singapore-based team.