A web application firewall (WAF) functions as a security layer for web applications. It filters and monitors HTTP traffic between a web application and the internet, blocking malicious requests and attacks such as SQL injection and cross-site scripting (XSS). By analyzing incoming web traffic, a WAF helps identify and mitigate threats, ensuring that the application remains secure while maintaining its availability to legitimate users.