Avatar for Thijs de Zoete

Thijs de Zoete

Founder & Editor

WAF Implementation Cloud Security Security Architecture DevSecOps
@wafplanet LinkedIn thijsdezoete

About

Thijs de Zoete is the founder of WAFPlanet and leads the editorial team in providing comprehensive, unbiased WAF reviews and comparisons.

With a background in security engineering and DevOps, Thijs understands the challenges mid-market companies face when evaluating and implementing web application firewalls.

The WAFPlanet team combines hands-on experience with major WAF providers to deliver practical advice that helps security teams make informed decisions.

Articles by Thijs de Zoete

Security News · · 6 min read

Poisoned Weights: The $100 Supply Chain Attack on Self-Hosted AI

Self-hosted AI feels safe. Your box, your weights, your data. New research breaks that. Ten poisoned training examples made a coding model write exploitable code 99% of the time, and benchmarks stayed blind. Your weights are a supply chain now. Here is what to do about it.

Comparisons · · 20 min read

The CAPTCHA Economy: How WAFs Integrate Challenges in 2026 (and Why Bypasses Cost Less Than Protection)

Every website is getting scraped. CAPTCHAs are one answer, but the landscape has fragmented: Google reCAPTCHA lost its monopoly, Cloudflare Turnstile runs free (sort of), and bypass services solve them for less than Google charges for Enterprise assessments. Meanwhile, WAFs are adding native CAPTCHA challenge actions. This post maps the whole picture: the providers, the pricing, the bypass economics, and which WAFs can actually issue a challenge today.

Comparisons · · 11 min read

AI Firewalls, LLM Firewalls, and AI Gateways: The 2026 Vendor Map

Searching for "AI firewall vendors" or "LLM firewall vendors" returns a wall of products that do not agree on what they are. Here is the map: the two layers you actually buy, the vendors in each, the consolidation wave that just absorbed half of them, and where a WAF does and does not help.

Best Practices · · 19 min read

AI-Powered WAFs in 2026: How to Tell a Real Model From a Sticker

Every WAF now claims to be "AI-powered," but the badge covers everything from a real self-learning model to a rule score with a sticker on it. Here is what is actually inside one, where the research shows it gets bypassed, and how to tell real from sticker before you buy.

Best Practices · · 25 min read

Secure LLM Inference, Part 2: Hardening Self-Hosted Models

Run the model yourself and you inherit a server, one that ships wide open. A data-backed tour of exposed inference endpoints, KV-cache prompt leaks, and backdoored weights, plus SEAL, four rules for locking the box down.

Best Practices · · 16 min read

Secure LLM Inference, Part 1: Defending API-Based AI Apps

The model is not a security boundary, and no prompt will make it one. A data-backed look at why prompt-level defenses leak, what actually drives attack success rates toward zero, and the five-rule CLAMP framework you can ship this week.

Security News · · 8 min read

Thousands of Zero-Days Are About to Go Public. Is Your WAF Ready?

CVSS scores assume exploiting vulnerabilities requires human expertise. Anthropic's Mythos just produced thousands of working exploits for $2K each. Every "medium" in your backlog is now effectively a "high." Here's the data and what to do about it.

Comparisons · · 15 min read

6 Best Cloudflare WAF Alternatives in 2026 (Compared)

Cloudflare's free WAF is popular but not always the best fit. We compare 6 alternatives (AWS WAF, Sucuri, Imperva, Fastly, Wordfence, Akamai) on price, features, and protection quality to help you pick the right one.

Tutorials · · 16 min read

WAF for WordPress: Complete Security Guide 2026

WordPress powers over 40% of the web and is a top target for attackers. This guide compares the best WAF solutions for WordPress, covering Cloudflare, Wordfence, and Sucuri in depth.

Comparatifs · · 12 min read

Cloudflare WAF vs AWS WAF : Lequel choisir en 2024 ?

Une comparaison complète de deux fournisseurs WAF leaders. Nous analysons les prix, les fonctionnalités, la facilité d'utilisation et les performances pour vous aider à faire le bon choix.

Platform Guides by Thijs de Zoete

Platform · HAProxy

Best WAF for HAProxy

Add a web application firewall to HAProxy. Compare the native HAProxy Enterprise WAF against out-of-process SPOA options (coraza-spoa, ModSecurity SPOA) and CrowdSec for load balancer and reverse proxy security.

Platform · Vercel

Best WAF for Vercel

Secure applications deployed on Vercel with a web application firewall. Compare the native Vercel WAF (custom rules, IP blocking, rate limiting, managed rulesets, Attack Mode) against fronting your app with a full third-party WAF such as Cloudflare.

Platform · Serverless

Best WAF for Serverless

Protect your serverless applications on AWS Lambda, Google Cloud Functions, and Azure Functions. Compare cloud-native WAFs, edge protection, and API security platforms for serverless architectures.

Platform · On-Premises

Best WAF for On-Premises

Protect your on-premises infrastructure with WAF solutions that don't require cloud dependencies. Compare hardware appliances, software WAFs, and hybrid options for data centers and private networks.

Platform · Apache

Best WAF for Apache

Protect your Apache HTTP Server with the right WAF. Compare OWASP ModSecurity (originally built for Apache), cloud-based WAFs, and modern alternatives for securing your web applications.

Platform · Magento

Best WAF for Magento & Adobe Commerce

Protect your Magento or Adobe Commerce store from Magecart attacks, payment fraud, and platform-specific vulnerabilities with specialized WAF solutions.

Platform · Docker

Best WAF for Docker

Secure your Docker containers with the right WAF. Compare Docker-native reverse-proxy WAFs, sidecar deployments, and cloud options for Docker, Docker Compose, and Docker Swarm.

Platform · NGINX

Best WAF for NGINX

Protect your NGINX deployment with the right WAF. Compare OWASP ModSecurity, F5 WAF for NGINX (formerly NGINX App Protect), BunkerWeb, and cloud-based options for reverse proxy and load balancer security.

Platform · WordPress

Best WAF for WordPress

Protect your WordPress site from hackers, bots, and malware. Compare endpoint firewalls like Wordfence, cloud WAFs like Cloudflare and Sucuri, and self-hosted options.

Platform · Kubernetes

Best WAF for Kubernetes

Protect your Kubernetes workloads with container-native WAF solutions. Compare Ingress Controller WAFs, Gateway API options, sidecar deployments, and cloud-native security platforms for EKS, GKE, and AKS.

Platform · Google Cloud

Best WAF for Google Cloud

Find the optimal WAF solution for Google Cloud Platform. Compare Cloud Armor and third-party edge WAFs from Cloudflare, Imperva, Fastly, and Akamai for GCE, GKE, and Cloud Run workloads.

Platform · Azure

Best WAF for Azure

Discover the best Web Application Firewall options for Microsoft Azure. Compare Azure WAF, Cloudflare, Imperva, Barracuda, and F5 across Application Gateway and Azure Front Door.

Platform · AWS

Best WAF for AWS

Find the best Web Application Firewall for your AWS infrastructure. Compare native AWS WAF and third-party WAF solutions for CloudFront, ALB, API Gateway, App Runner, Cognito, Amplify, and Amazon Bedrock AgentCore Gateway.