Three security decisions that often get mixed together
A supplier can offer excellent protection at one point without covering the rest of your website. A WAF, or web application firewall, evaluates web and API traffic against rules. Cloudflare's WAF documentation describes this request-filtering role. Network controls instead govern which connections are allowed between systems. A hosted backend provides application functions, such as login or storage, from a provider-operated service.
These are distinct purchasing decisions. A firewall rule does not decide which customer owns an order. Moving login to a provider does not protect an employee's laptop. Start by writing the unwanted outcome in ordinary language, then locate the system where a control can change it.
Match the control to the actual problem
| Problem | Relevant layer | Question to ask |
|---|---|---|
| Unwanted requests reach the website | WAF and application controls | Which requests can be inspected and acted on? |
| An administration service is exposed broadly | Network and administrator access | Who actually needs to connect? |
| The team maintains its own login and user database | Hosted backend evaluation | Which functions can move to a suitable provider? |
| A signed-in customer changes an order they do not own | Application authorization | Where is ownership checked and enforced? |
| A deployment account is stolen | Account and deployment security | How can access be constrained and recovered? |
A single incident can cross several rows. Record an owner for each layer so that “the security provider handles it” never becomes the explanation for an unassigned task.
Draw the real traffic paths before adding a WAF
Write down the addresses the browser contacts during a normal visit, login, data load and payment. Separate your website host from external service hosts. A WAF placed in front of your website only evaluates traffic passing through that arrangement. Do not assume that it also controls requests sent directly from a browser to a separate provider.
For each path, record who operates the receiving service and who can change its configuration. Ask your hosting or security provider how direct access to the origin is handled. If you introduce proxying or other network changes, verify that they are supported by every affected service rather than improvising around documented integration rules.
This small map also helps diagnose problems. A failed login may be a blocked popup, a domain mismatch or a rejected request at another service. Disabling every security rule at once makes the cause harder to establish.
Illustrative scenario: an appointment website in Cairo
Imagine a small appointment website using Gammal Tech for hosted login and per-user saved preferences. The website files sit with a hosting provider. Its owner is deciding whether a WAF and a managed backend are substitutes.
The backend reduces the need to operate those supported functions locally. A WAF may add useful filtering on the website's own incoming traffic. Neither decision removes the need to protect the account that publishes the website. If an attacker changes its JavaScript, the attacker may alter what visitors see or access data available to a signed-in page. This is an architectural consequence of compromised frontend code, consistent with the risks described in OWASP's third-party JavaScript guidance.
The owner therefore makes three assignments: the hosting contact handles website traffic controls, the developer maintains the integration and frontend, and a named business owner controls administrator access. They assess any remaining specialist needs separately.
What Gammal Tech contributes to the design
Gammal Tech's documented services include hosted login, application user-data storage and hosted payment links. Those services can reduce the infrastructure a company must build and maintain for a suitable website. This is a backend security contribution, not a documented offer of a company-wide network firewall or managed WAF service.
Registered HTTPS domains, a public project identifier and a valid user session have different purposes. Treat session credentials as sensitive. Registration of a domain does not make malicious code running on that domain trustworthy, and it does not decide which business actions a user is entitled to perform.
A practical rollout checklist
- Capture normal behavior. Test the public pages, login, saved data and payment handoff on supported devices.
- Define control ownership. Record who can adjust filtering, deploy code and contact each provider.
- Change one layer at a time. Keep a record of the configuration and a safe rollback route.
- Use narrow exceptions. If legitimate traffic fails, identify the exact cause before relaxing broader protection.
- Review real outcomes. Track failed customer tasks as well as security events.
The useful result is a website whose boundaries are understood and maintained. A list of security products without that understanding can leave gaps between otherwise capable services.
Common questions
Does a WAF replace secure application code?
No. Request filtering and application design address different problems. Ownership checks, trusted payment decisions and safe frontend code remain necessary.
Do I need a WAF if I use Gammal Tech?
Assess the website and hosting risks that remain. Gammal Tech provides documented backend functions; whether your website needs an additional WAF depends on its exposure and existing controls.