Web application firewall
WAF. A reverse proxy that tries to stop common web attacks before the app. Rules, not a rewrite of the application.
A web application firewall sits in front of HTTP and HTTPS services and filters requests: injection probes, known exploit paths, bot noise, sometimes odd authentication. It is defence in depth, not a substitute for patching the app.
Bypasses exist. So do false positives that break checkout. Log blocks and passes. A WAF in alert-only forever is an expensive mirror. Tune it, then enforce.
See also: Firewall, Intrusion detection system (IDS), Transport Layer Security (TLS).