A web application firewall (WAF) is an appliance, server plugin, or a software filter that applies a set of rules to an HTTP conversation. It typically acts as a countermeasure over common attacks such as Cross-site Scripting (XSS), Cross Site Request Forgery (CSRF) and SQL Injection. OWASP suggests the following selection criteria for a web application firewall: