Do I need a WAF on top of my load balancer?

Usually yes, if you expose web applications to the internet and you have any meaningful security or compliance requirements. But it depends on what your load balancer already does and what you’re protecting.

Short answer

A load balancer and a WAF (Web Application Firewall) solve different problems:

• Load balancer: distributes traffic, improves availability, may terminate TLS, and sometimes offers basic L7 routing/rate limiting.
• WAF: inspects HTTP/S traffic for malicious patterns and blocks things like:
  • SQL injection
  • XSS
  • path traversal
  • protocol abuse
  • some bot and attack traffic
  • known exploit signatures

So a WAF is often an additional layer, not a replacement.

You likely need a WAF if:

• You have a public-facing web app or API
• You handle sensitive data
• You need PCI DSS / regulatory compliance
• You want protection against common web attacks
• Your app is a target for bots, scraping, credential stuffing, or exploit scanning
• You don’t want to rely entirely on application code to catch malicious requests

You might not need one if:

• The service is internal-only
• It’s not HTTP/S or not a web app
• You have a very small, low-risk public surface and strong app-layer controls
• Your load balancer/platform already includes a WAF-like managed protection that meets your needs
• You’re using another edge service that already provides WAF/CDN protection

Important nuance

Some cloud “load balancers” are just L4/L7 traffic managers, while others are part of a broader edge stack and may integrate with a WAF:

• AWS: ALB + AWS WAF
• Azure: Application Gateway + WAF
• GCP: Load balancing + Cloud Armor
• Cloudflare/Fastly/Akamai: often WAF is part of the edge platform

If your “load balancer” already includes WAF features, you may not need a separate product.

Practical recommendation

For most internet-facing apps:

1. Use a load balancer
2. Add a WAF at the edge
3. Also secure the app itself (auth, input validation, rate limits, CSRF protection, logging, patching)

A WAF is best as a defense-in-depth layer, not your primary security control.

If you tell me which cloud/provider you’re using and whether this is a public web app or API, I can tell you more specifically whether a separate WAF makes sense.