OWASP Top 10 (2025): what a WAF covers, and what it does not
The ten categories of the 2025 OWASP Top 10, one by one, with what a web application firewall such as Zyre can actually do about each. Short answer: a lot for one, partly for five, nothing for four.
7 minUpdated
The OWASP Top 10 is the reference list of web application security risks, published by the OWASP Foundation. Its 2025 edition replaces the 2021 one: two categories are new (software supply chain failures and mishandling of exceptional conditions), and server-side request forgery (SSRF) is merged into access control.
Beware of "OWASP compliant"
The OWASP Top 10 is a list of application risks, not a product standard: no WAF "covers the OWASP Top 10". Several categories are code or design flaws that show up in no request. A vendor claiming otherwise is selling an impression.
Category by category
| Category (2025) | What a WAF does | Coverage |
|---|---|---|
| A01 — Broken Access Control | Blocks direct access to sensitive files and SSRF probes towards internal services. Cannot know that a user is viewing someone else's invoice: the request is valid. | Partial |
| A02 — Security Misconfiguration | Refuses files exposed by mistake (.env, .git, backups, diagnostic pages). Does not fix the configuration itself. | Partial |
| A03 — Software Supply Chain Failures | Out of reach of a request filter. Zyre's threat intelligence flags known flaws in the technologies detected on your site, which covers part of the risk, without a full dependency inventory. | Partial (intelligence) |
| A04 — Cryptographic Failures | Transport encryption is handled at the edge (TLS). How your application stores passwords or data cannot be seen from a request. | No |
| A05 — Injection | The core of the job: SQL injection, XSS, command and template injection, path traversal — in the URL, parameters, parameter names and form bodies. | Strong |
| A06 — Insecure Design | A design flaw produces perfectly normal requests. | No |
| A07 — Authentication Failures | Per-IP rate limiting slows down mass password guessing. Replaces neither a password policy nor two-factor authentication. | Partial |
| A08 — Software or Data Integrity Failures | Blocks a few recognisable forms (prototype pollution, for instance), not the lack of integrity checks in your code. | Marginal |
| A09 — Security Logging & Alerting Failures | Every block is logged with its rule, address and path, and can trigger an alert. Does not replace your application's own logs. | Partial |
| A10 — Mishandling of Exceptional Conditions | How your code reacts to an error cannot be read from the request. | No |
How to read this table
A web application firewall is very effective against risks that show up in a request — injection first — and has no effect on risks that are decided in your code. The two complement each other: the WAF protects you while the flaw still exists, fixing the code makes it go away.
That is also why Zyre's rules are written per technology: an injection against a WordPress form does not look like one against a Laravel API. See technologies and their flaws.
Read next
What is a web application firewall (WAF)?
A WAF inspects every HTTP request before it reaches your site, and refuses the ones carrying an attack. How it works, what it stops, and what it cannot stop.
False positives
When a legitimate visit is blocked: how to spot it, report it, and what happens next.
NIS2 and your website: who is in scope, and what a WAF changes
What the NIS2 directive requires, which companies it covers, where the French transposition law stands, and the real place of a web application firewall in a compliance effort.
This page did not answer your question?
Contact us