{"id":2254,"date":"2026-08-26T10:13:16","date_gmt":"2026-08-26T07:13:16","guid":{"rendered":"https:\/\/verimin.com.tr\/blog\/?p=2254"},"modified":"2026-08-26T10:13:16","modified_gmt":"2026-08-26T07:13:16","slug":"waf-nedir","status":"publish","type":"post","link":"https:\/\/verimin.com.tr\/blog\/waf-nedir\/","title":{"rendered":"WAF (Web Application Firewall) Nedir? Ne \u0130\u015fe Yarar ve Nas\u0131l \u00c7al\u0131\u015f\u0131r?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">WAF (web application firewall), bir web uygulamas\u0131na gelen HTTP ve HTTPS isteklerini uygulama katman\u0131nda denetleyen ve zararl\u0131 olanlar\u0131 sunucuya ula\u015fmadan durduran g\u00fcvenlik katman\u0131d\u0131r. T\u00fcrk\u00e7ede ayn\u0131 katman <strong>web uygulama g\u00fcvenlik duvar\u0131<\/strong> ad\u0131yla an\u0131l\u0131r; ikisi ayn\u0131 \u015feyi anlat\u0131r.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WAF, ziyaret\u00e7i ile <strong>sunucu<\/strong> aras\u0131nda konumlan\u0131r ve trafi\u011fi ba\u011flant\u0131 d\u00fczeyinde de\u011fil, istek d\u00fczeyinde inceler. Denetledi\u011fi \u015fey iste\u011fin kendisidir: adres sat\u0131r\u0131, ba\u015fl\u0131klar, \u00e7erezler ve form verisi. Bu sayede SQL injection, XSS, dizin a\u015f\u0131m\u0131 ve k\u00f6t\u00fc niyetli bot trafi\u011fi gibi do\u011frudan uygulamay\u0131 hedefleyen sald\u0131r\u0131lar\u0131 engeller. Klasik g\u00fcvenlik duvar\u0131ndan ayr\u0131ld\u0131\u011f\u0131 nokta da budur: klasik g\u00fcvenlik duvar\u0131 bir paketin ge\u00e7ip ge\u00e7emeyece\u011fine karar verir, WAF iste\u011fin i\u00e7eri\u011finin zararl\u0131 olup olmad\u0131\u011f\u0131na karar verir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WAF d\u00f6rt bi\u00e7imde kar\u015f\u0131m\u0131za \u00e7\u0131kar: web sunucusu \u00fczerinde mod\u00fcl olarak \u00e7al\u0131\u015fan sunucu tabanl\u0131 WAF (ModSecurity), trafi\u011fi alan ad\u0131 seviyesinde kar\u015f\u0131layan bulut tabanl\u0131 WAF, veri merkezinde ayr\u0131 cihaz olarak duran donan\u0131m tabanl\u0131 WAF ve uygulaman\u0131n i\u00e7ine kurulan eklenti tabanl\u0131 WAF. D\u00f6rd\u00fcn\u00fcn ortak s\u0131n\u0131r\u0131 ayn\u0131d\u0131r: <strong>WAF bir filtredir, uygulamadaki a\u00e7\u0131\u011f\u0131 kapatmaz.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A\u015fa\u011f\u0131da WAF&#8217;\u0131n nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, neyi engelleyip neyi engelleyemedi\u011fini, \u00e7e\u015fitlerini, kurulduktan sonra hangi ayarlar\u0131n yap\u0131ld\u0131\u011f\u0131n\u0131 ve neden tek ba\u015f\u0131na yeterli olmad\u0131\u011f\u0131n\u0131 a\u00e7\u0131kl\u0131yoruz.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_73 ez-toc-wrap-left counter-flat ez-toc-counter ez-toc-white ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<div class=\"ez-toc-title\" style=\"cursor:inherit\">\u0130\u00e7erik Ba\u015fl\u0131klar\u0131:<\/div>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_nasil_calisir\" title=\"WAF nas\u0131l \u00e7al\u0131\u015f\u0131r?\">WAF nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_hangi_olcute_gore_karar_verir\" title=\"WAF hangi \u00f6l\u00e7\u00fcte g\u00f6re karar verir?\">WAF hangi \u00f6l\u00e7\u00fcte g\u00f6re karar verir?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_hangi_saldirilari_engeller\" title=\"WAF hangi sald\u0131r\u0131lar\u0131 engeller?\">WAF hangi sald\u0131r\u0131lar\u0131 engeller?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#SQL_injection_nedir_ve_WAF_bunu_nasil_durdurur\" title=\"SQL injection nedir ve WAF bunu nas\u0131l durdurur?\">SQL injection nedir ve WAF bunu nas\u0131l durdurur?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#XSS_saldirisi_WAF_ile_nasil_engellenir\" title=\"XSS sald\u0131r\u0131s\u0131 WAF ile nas\u0131l engellenir?\">XSS sald\u0131r\u0131s\u0131 WAF ile nas\u0131l engellenir?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_hangi_saldirilari_engelleyemez\" title=\"WAF hangi sald\u0131r\u0131lar\u0131 engelleyemez?\">WAF hangi sald\u0131r\u0131lar\u0131 engelleyemez?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_ile_klasik_guvenlik_duvari_arasindaki_fark_nedir\" title=\"WAF ile klasik g\u00fcvenlik duvar\u0131 aras\u0131ndaki fark nedir?\">WAF ile klasik g\u00fcvenlik duvar\u0131 aras\u0131ndaki fark nedir?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_cesitleri_nelerdir_ve_nerede_konumlandirilir\" title=\"WAF \u00e7e\u015fitleri nelerdir ve nerede konumland\u0131r\u0131l\u0131r?\">WAF \u00e7e\u015fitleri nelerdir ve nerede konumland\u0131r\u0131l\u0131r?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#ModSecurity_nedir_ve_sunucuda_nasil_calisir\" title=\"ModSecurity nedir ve sunucuda nas\u0131l \u00e7al\u0131\u015f\u0131r?\">ModSecurity nedir ve sunucuda nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#Bulut_tabanli_WAF_nasil_calisir\" title=\"Bulut tabanl\u0131 WAF nas\u0131l \u00e7al\u0131\u015f\u0131r?\">Bulut tabanl\u0131 WAF nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WordPresste_WAF_nasil_saglanir\" title=\"WordPress&#8217;te WAF nas\u0131l sa\u011flan\u0131r?\">WordPress&#8217;te WAF nas\u0131l sa\u011flan\u0131r?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_kurulduktan_sonra_hangi_ayarlar_yapilir\" title=\"WAF kurulduktan sonra hangi ayarlar yap\u0131l\u0131r?\">WAF kurulduktan sonra hangi ayarlar yap\u0131l\u0131r?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_yanlis_pozitif_verirse_ne_yapilir\" title=\"WAF yanl\u0131\u015f pozitif verirse ne yap\u0131l\u0131r?\">WAF yanl\u0131\u015f pozitif verirse ne yap\u0131l\u0131r?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_istek_sayisini_nasil_sinirlar\" title=\"WAF istek say\u0131s\u0131n\u0131 nas\u0131l s\u0131n\u0131rlar?\">WAF istek say\u0131s\u0131n\u0131 nas\u0131l s\u0131n\u0131rlar?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_tek_basina_neden_yeterli_degildir\" title=\"WAF tek ba\u015f\u0131na neden yeterli de\u011fildir?\">WAF tek ba\u015f\u0131na neden yeterli de\u011fildir?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_hakkinda_sik_sorulan_sorular\" title=\"WAF hakk\u0131nda s\u0131k sorulan sorular\">WAF hakk\u0131nda s\u0131k sorulan sorular<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#WAF_siteyi_yavaslatir_mi\" title=\"WAF siteyi yava\u015flat\u0131r m\u0131?\">WAF siteyi yava\u015flat\u0131r m\u0131?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#Ucretsiz_WAF_yeterli_midir\" title=\"\u00dccretsiz WAF yeterli midir?\">\u00dccretsiz WAF yeterli midir?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#SSL_sertifikasi_WAF_yerine_gecer_mi\" title=\"SSL sertifikas\u0131 WAF yerine ge\u00e7er mi?\">SSL sertifikas\u0131 WAF yerine ge\u00e7er mi?<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/verimin.com.tr\/blog\/waf-nedir\/#Paylasimli_hosting_paketinde_WAF_kullanilabilir_mi\" title=\"Payla\u015f\u0131ml\u0131 hosting paketinde WAF kullan\u0131labilir mi?\">Payla\u015f\u0131ml\u0131 hosting paketinde WAF kullan\u0131labilir mi?<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_nasil_calisir\"><\/span>WAF nas\u0131l \u00e7al\u0131\u015f\u0131r?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WAF, kendisine ula\u015fan her iste\u011fi bir kural setinden ge\u00e7irerek \u00e7al\u0131\u015f\u0131r. Sunucuya giden yolun \u00fczerinde durur ve iste\u011fi d\u00f6rt ad\u0131mda i\u015fler:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Yakala.<\/strong> Ziyaret\u00e7iden gelen iste\u011fi, sunucudaki uygulama \u00e7al\u0131\u015fmaya ba\u015flamadan \u00f6nce al.<\/li><li><strong>Kar\u015f\u0131la\u015ft\u0131r.<\/strong> \u0130ste\u011fin adresini, ba\u015fl\u0131klar\u0131n\u0131, \u00e7erezlerini ve g\u00f6vdesindeki form verisini kural setiyle kar\u015f\u0131la\u015ft\u0131r.<\/li><li><strong>Karar ver.<\/strong> \u0130ste\u011fi ge\u00e7ir, engelle, ziyaret\u00e7iden do\u011frulama iste ya da yaln\u0131zca kaydedip ge\u00e7ir.<\/li><li><strong>Kaydet.<\/strong> Karar\u0131, e\u015fle\u015fen kural\u0131n kimli\u011fiyle birlikte log dosyas\u0131na yaz.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Engelleme karar\u0131 ziyaret\u00e7iye \u00e7o\u011funlukla <strong>HTTP 403<\/strong> yan\u0131t\u0131yla d\u00f6ner; istek uygulamaya ve veritaban\u0131na hi\u00e7 ula\u015fmaz. WAF iste\u011fin i\u00e7eri\u011fini ancak TLS ba\u011flant\u0131s\u0131 sonland\u0131r\u0131ld\u0131ktan sonra okuyabilir. \u00dc\u00e7\u00fcnc\u00fc ad\u0131m, yani karar ad\u0131m\u0131, WAF&#8217;lar aras\u0131ndaki as\u0131l fark\u0131n \u00e7\u0131kt\u0131\u011f\u0131 yerdir.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_hangi_olcute_gore_karar_verir\"><\/span>WAF hangi \u00f6l\u00e7\u00fcte g\u00f6re karar verir?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WAF, iki g\u00fcvenlik modelinden birine g\u00f6re karar verir: negatif model ve pozitif model. Negatif model bilinen zararl\u0131 kal\u0131plar\u0131 tan\u0131r ve yaln\u0131zca onlar\u0131 engeller; tan\u0131mad\u0131\u011f\u0131 yeni bir sald\u0131r\u0131 bi\u00e7imini ka\u00e7\u0131rabilir. Pozitif model yaln\u0131zca tan\u0131ml\u0131 istek bi\u00e7imlerine izin verir; kapsam\u0131 dard\u0131r ama me\u015fru istekleri yanl\u0131\u015fl\u0131kla engelleme olas\u0131l\u0131\u011f\u0131 y\u00fcksektir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Uygulamada ikisi birlikte kullan\u0131l\u0131r ve karar <strong>skor tabanl\u0131<\/strong> verilir. Her e\u015fle\u015fen kural iste\u011fe puan ekler; toplam puan belirlenen e\u015fi\u011fi (yayg\u0131n kural setlerinde <strong>5 puan<\/strong>) a\u015ft\u0131\u011f\u0131nda istek engellenir. B\u00f6ylece tek bir i\u015faret de\u011fil, i\u015faretlerin birikimi karar \u00fcretir. Kurallar\u0131n hedefledi\u011fi sald\u0131r\u0131 s\u0131n\u0131flar\u0131 WAF&#8217;\u0131n kapsam\u0131n\u0131 belirler.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1672\" height=\"941\" src=\"https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-hangi-saldirilari-engeller.avif\" alt=\"WAF&#x27;\u0131n engelledi\u011fi d\u00f6rt uygulama katman\u0131 sald\u0131r\u0131s\u0131\" class=\"wp-image-2245\" srcset=\"https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-hangi-saldirilari-engeller.avif 1672w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-hangi-saldirilari-engeller-300x169.avif 300w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-hangi-saldirilari-engeller-1024x576.avif 1024w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-hangi-saldirilari-engeller-768x432.avif 768w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-hangi-saldirilari-engeller-1536x864.avif 1536w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-hangi-saldirilari-engeller-195x110.avif 195w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-hangi-saldirilari-engeller-390x220.avif 390w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-hangi-saldirilari-engeller-1170x658.avif 1170w\" sizes=\"auto, (max-width: 1672px) 100vw, 1672px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_hangi_saldirilari_engeller\"><\/span>WAF hangi sald\u0131r\u0131lar\u0131 engeller?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WAF, uygulama katman\u0131nda y\u00fcr\u00fct\u00fclen sald\u0131r\u0131lar\u0131 engeller. Bu s\u0131n\u0131flar\u0131n referans \u00e7er\u00e7evesini, uygulama g\u00fcvenli\u011finde en \u00e7ok at\u0131f alan liste olan <strong>OWASP Top 10<\/strong> \u00e7izer; yayg\u0131n kural setleri kapsam\u0131n\u0131 bu \u00e7er\u00e7eveye g\u00f6re belirler.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WAF&#8217;\u0131n tipik olarak durdurdu\u011fu istek tipleri a\u015fa\u011f\u0131da verilmi\u015ftir:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>SQL injection.<\/strong> Kullan\u0131c\u0131 verisine gizlenmi\u015f veritaban\u0131 sorgusu; hedefi sunucudaki veritaban\u0131d\u0131r.<\/li><li><strong>XSS (siteler aras\u0131 betik \u00e7al\u0131\u015ft\u0131rma).<\/strong> \u0130stek i\u00e7ine yerle\u015ftirilen ve ziyaret\u00e7inin taray\u0131c\u0131s\u0131nda \u00e7al\u0131\u015fan betik.<\/li><li><strong>Uzaktan dosya \u00e7al\u0131\u015ft\u0131rma.<\/strong> Sunucuya \u00e7al\u0131\u015ft\u0131r\u0131labilir dosya b\u0131rakmay\u0131 hedefleyen istek.<\/li><li><strong>Dizin a\u015f\u0131m\u0131 (path traversal).<\/strong> Adres sat\u0131r\u0131ndaki yol ifadesiyle uygulama dizininin d\u0131\u015f\u0131na \u00e7\u0131kma denemesi.<\/li><li><strong>Komut enjeksiyonu.<\/strong> \u0130stek parametresine gizlenmi\u015f, i\u015fletim sistemi kabu\u011funa y\u00f6nelen komut.<\/li><li><strong>Kimlik do\u011frulama sald\u0131r\u0131lar\u0131.<\/strong> Giri\u015f formuna yap\u0131lan yo\u011fun deneme-yan\u0131lma istekleri.<\/li><li><strong>K\u00f6t\u00fc niyetli bot trafi\u011fi.<\/strong> \u0130\u00e7erik kopyalayan veya a\u00e7\u0131k tarayan otomatik istekler.<\/li><li><strong>Uygulama katman\u0131 istek seli.<\/strong> Sunucu kayna\u011f\u0131n\u0131 t\u00fcketmek i\u00e7in tek sayfaya y\u00f6neltilen yo\u011fun istek.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Listenin ilk iki maddesi kural setlerinde a\u011f\u0131rl\u0131\u011f\u0131 en y\u00fcksek ikilidir; bu y\u00fczden ayr\u0131 ele al\u0131n\u0131r.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"SQL_injection_nedir_ve_WAF_bunu_nasil_durdurur\"><\/span>SQL injection nedir ve WAF bunu nas\u0131l durdurur?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SQL injection, kullan\u0131c\u0131dan gelen veriye gizlenmi\u015f bir SQL ifadesinin veritaban\u0131nda \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131d\u0131r. Uygulama, gelen parametreyi do\u011frulamadan sorguya yerle\u015ftirdi\u011finde sald\u0131rgan\u0131n yazd\u0131\u011f\u0131 ifade de sorgunun par\u00e7as\u0131 olur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WAF bu sald\u0131r\u0131y\u0131, istek parametrelerindeki SQL s\u00f6zdizimi kal\u0131plar\u0131n\u0131 tan\u0131yarak durdurur; e\u015fle\u015fme bulundu\u011funda sorgu MySQL gibi veritaban\u0131 sunucular\u0131na hi\u00e7 iletilmez. MySQL katman\u0131n\u0131n bar\u0131nd\u0131rma taraf\u0131nda nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 <a href=\"https:\/\/verimin.com.tr\/blog\/mysql-hosting\/\">MySQL Nedir? MySQL Hosting Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/a> yaz\u0131s\u0131nda anlatt\u0131k. WAF&#8217;\u0131n buradaki rol\u00fc kalkand\u0131r; kal\u0131c\u0131 \u00e7\u00f6z\u00fcm, uygulaman\u0131n parametreli sorgu (prepared statement) kullanmas\u0131d\u0131r.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"XSS_saldirisi_WAF_ile_nasil_engellenir\"><\/span>XSS sald\u0131r\u0131s\u0131 WAF ile nas\u0131l engellenir?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">XSS sald\u0131r\u0131s\u0131, WAF&#8217;\u0131n istek i\u00e7indeki betik kal\u0131plar\u0131n\u0131 tan\u0131y\u0131p iste\u011fi engellemesiyle durdurulur. XSS&#8217;in T\u00fcrk\u00e7e kar\u015f\u0131l\u0131\u011f\u0131 siteler aras\u0131 betik \u00e7al\u0131\u015ft\u0131rmad\u0131r ve \u00fc\u00e7 bi\u00e7imi vard\u0131r: yans\u0131yan, depolanan ve DOM tabanl\u0131.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SQL injection&#8217;dan fark\u0131 hedefindedir: SQL injection sunucudaki veritaban\u0131n\u0131, XSS ziyaret\u00e7inin taray\u0131c\u0131s\u0131n\u0131 hedefler. WAF her iki durumda da ayn\u0131 noktada devreye girer, \u00e7\u00fcnk\u00fc ikisi de sunucuya gelen bir istekle ba\u015flar. Ancak WAF&#8217;\u0131n kapsam\u0131 burada biter.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_hangi_saldirilari_engelleyemez\"><\/span>WAF hangi sald\u0131r\u0131lar\u0131 engelleyemez?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WAF, uygulama katman\u0131n\u0131n d\u0131\u015f\u0131nda kalan sald\u0131r\u0131lar\u0131 engelleyemez. Bu s\u0131n\u0131r\u0131n d\u00f6rt \u00f6rne\u011fi vard\u0131r.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Birincisi hacimsel DDoS sald\u0131r\u0131lar\u0131d\u0131r: bant geni\u015fli\u011fini dolduran trafik WAF&#8217;a ula\u015fmadan hatt\u0131 t\u0131kar, koruma daha \u00f6nde \u00e7\u00f6z\u00fcl\u00fcr (<a href=\"https:\/\/verimin.com.tr\/blog\/ddos-nedir\/\">DDoS Nedir?<\/a>). \u0130kincisi sunucuya zaten yerle\u015fmi\u015f zararl\u0131 yaz\u0131l\u0131m (malware) dosyalar\u0131d\u0131r; WAF gelen iste\u011fe bakar, diskteki dosyay\u0131 temizlemez (<a href=\"https:\/\/verimin.com.tr\/blog\/malware-temizleme\/\">Malware Nedir? Hostingte K\u00f6t\u00fc Ama\u00e7l\u0131 Yaz\u0131l\u0131m Nas\u0131l Temizlenir?<\/a>). \u00dc\u00e7\u00fcnc\u00fcs\u00fc \u00e7al\u0131nm\u0131\u015f kimlik bilgisiyle yap\u0131lan giri\u015ftir; istek me\u015fru g\u00f6r\u00fcnd\u00fc\u011f\u00fc i\u00e7in kural e\u015fle\u015fmez. D\u00f6rd\u00fcnc\u00fcs\u00fc sunucu yaz\u0131l\u0131m\u0131n\u0131n g\u00fcncellenmemi\u015f a\u00e7\u0131\u011f\u0131d\u0131r.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bu s\u0131n\u0131rlar\u0131n hepsi WAF&#8217;\u0131n hangi katmanda durdu\u011fuyla ilgilidir. Katman fark\u0131, WAF ile klasik g\u00fcvenlik duvar\u0131n\u0131 ay\u0131ran \u00f6l\u00e7\u00fctt\u00fcr.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1672\" height=\"941\" src=\"https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-firewall-farki.avif\" alt=\"WAF ile klasik g\u00fcvenlik duvar\u0131n\u0131n katman ve filtreleme fark\u0131\" class=\"wp-image-2244\" srcset=\"https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-firewall-farki.avif 1672w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-firewall-farki-300x169.avif 300w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-firewall-farki-1024x576.avif 1024w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-firewall-farki-768x432.avif 768w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-firewall-farki-1536x864.avif 1536w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-firewall-farki-195x110.avif 195w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-firewall-farki-390x220.avif 390w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-firewall-farki-1170x658.avif 1170w\" sizes=\"auto, (max-width: 1672px) 100vw, 1672px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_ile_klasik_guvenlik_duvari_arasindaki_fark_nedir\"><\/span>WAF ile klasik g\u00fcvenlik duvar\u0131 aras\u0131ndaki fark nedir?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WAF ile klasik g\u00fcvenlik duvar\u0131 (firewall) aras\u0131ndaki fark, denetledikleri katmand\u0131r. \u0130kisi ayn\u0131 i\u015fin farkl\u0131 seviyelerini yapar:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>\u00d6l\u00e7\u00fct<\/th><th>Klasik g\u00fcvenlik duvar\u0131<\/th><th>WAF<\/th><\/tr><\/thead><tbody><tr><td>\u00c7al\u0131\u015ft\u0131\u011f\u0131 katman<\/td><td>A\u011f ve ta\u015f\u0131ma katman\u0131 (Layer 3\u20134)<\/td><td>Uygulama katman\u0131 (Layer 7)<\/td><\/tr><tr><td>Denetledi\u011fi \u015fey<\/td><td>IP adresi, port numaras\u0131, protokol<\/td><td>\u0130ste\u011fin adresi, ba\u015fl\u0131klar\u0131, \u00e7erezleri, form verisi<\/td><\/tr><tr><td>Karar \u00f6l\u00e7\u00fct\u00fc<\/td><td>Ba\u011flant\u0131 izinli mi<\/td><td>\u0130ste\u011fin i\u00e7eri\u011fi zararl\u0131 m\u0131<\/td><\/tr><tr><td>Tipik engel \u00f6rne\u011fi<\/td><td>Veritaban\u0131 portuna d\u0131\u015far\u0131dan gelen ba\u011flant\u0131<\/td><td>Adres sat\u0131r\u0131ndaki SQL ifadesi<\/td><\/tr><tr><td>\u015eifreli trafik<\/td><td>\u0130\u00e7eri\u011fi okumaz<\/td><td>TLS sonland\u0131r\u0131ld\u0131ktan sonra okur<\/td><\/tr><tr><td>Yetersiz kald\u0131\u011f\u0131 yer<\/td><td>Uygulama a\u00e7\u0131klar\u0131<\/td><td>A\u011f seviyesi tarama ve sel trafi\u011fi<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u0130kisi birbirinin yerine ge\u00e7mez, birlikte \u00e7al\u0131\u015f\u0131r: klasik g\u00fcvenlik duvar\u0131 gereksiz portlar\u0131 kapat\u0131r, WAF a\u00e7\u0131k kalan 80 ve 443 numaral\u0131 portlardan ge\u00e7en iste\u011fi denetler. A\u011f katman\u0131n\u0131n kural mant\u0131\u011f\u0131n\u0131 ve t\u00fcrlerini <a href=\"https:\/\/verimin.com.tr\/blog\/firewall-nedir\/\">Firewall (G\u00fcvenlik Duvar\u0131) Nedir?<\/a> yaz\u0131s\u0131nda ele ald\u0131k. WAF taraf\u0131nda as\u0131l soru, bu katman\u0131n nereye kuruldu\u011fudur.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1672\" height=\"941\" src=\"https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-cesitleri.avif\" alt=\"Gelen iste\u011fin bulut, sunucu ve eklenti tabanl\u0131 WAF katmanlar\u0131ndan ge\u00e7i\u015fi\" class=\"wp-image-2243\" srcset=\"https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-cesitleri.avif 1672w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-cesitleri-300x169.avif 300w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-cesitleri-1024x576.avif 1024w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-cesitleri-768x432.avif 768w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-cesitleri-1536x864.avif 1536w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-cesitleri-195x110.avif 195w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-cesitleri-390x220.avif 390w, https:\/\/verimin.com.tr\/blog\/wp-content\/uploads\/2026\/08\/waf-cesitleri-1170x658.avif 1170w\" sizes=\"auto, (max-width: 1672px) 100vw, 1672px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_cesitleri_nelerdir_ve_nerede_konumlandirilir\"><\/span>WAF \u00e7e\u015fitleri nelerdir ve nerede konumland\u0131r\u0131l\u0131r?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WAF \u00e7e\u015fitleri, \u00e7al\u0131\u015ft\u0131klar\u0131 yere g\u00f6re d\u00f6rde ayr\u0131l\u0131r: sunucu tabanl\u0131, bulut tabanl\u0131, donan\u0131m tabanl\u0131 ve eklenti tabanl\u0131 WAF. Fark yaln\u0131zca teknoloji de\u011fil, iste\u011fin hangi noktada durduruldu\u011fudur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bulut tabanl\u0131 WAF iste\u011fi alan ad\u0131 seviyesinde, sunucuya ula\u015fmadan kar\u015f\u0131lar; sunucu tabanl\u0131 WAF iste\u011fi web sunucusu \u00fczerinde, uygulama \u00e7al\u0131\u015fmadan hemen \u00f6nce kar\u015f\u0131lar. Trafi\u011fin birden \u00e7ok sunucuya da\u011f\u0131t\u0131ld\u0131\u011f\u0131 kurulumlarda WAF, y\u00fck dengeleyicinin (load balancer) \u00f6n\u00fcne ya da arkas\u0131na yerle\u015ftirilebilir (<a href=\"https:\/\/verimin.com.tr\/blog\/load-balancer-nedir\/\">Load Balancer (Y\u00fck Dengeleyici) Nedir?<\/a>). Donan\u0131m tabanl\u0131 WAF ayr\u0131 bir cihaz olarak veri merkezinde durur; F5 ve Fortinet \u00fcr\u00fcnleri bu s\u0131n\u0131fa girer, y\u00fcksek trafikli kurumsal uygulamalarda tercih edilir ve bar\u0131nd\u0131rma m\u00fc\u015fterisinin g\u00fcndemine nadiren girer. Bar\u0131nd\u0131rma taraf\u0131ndaki \u00fc\u00e7 bi\u00e7im a\u015fa\u011f\u0131dad\u0131r.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"ModSecurity_nedir_ve_sunucuda_nasil_calisir\"><\/span>ModSecurity nedir ve sunucuda nas\u0131l \u00e7al\u0131\u015f\u0131r?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ModSecurity, web sunucusu \u00fczerinde mod\u00fcl olarak \u00e7al\u0131\u015fan a\u00e7\u0131k kaynakl\u0131 bir WAF&#8217;t\u0131r. Apache, NGINX ve IIS \u00fczerinde \u00e7al\u0131\u015f\u0131r; kendi ba\u015f\u0131na kural i\u00e7ermez, d\u0131\u015far\u0131dan verilen bir kural setiyle beslenir. En yayg\u0131n kural seti <strong>OWASP Core Rule Set (CRS)<\/strong>, bar\u0131nd\u0131rma panellerinde sunulan haz\u0131r alternatiflerden biri de Comodo kural setidir. Mod\u00fcl\u00fcn \u00fczerinde \u00e7al\u0131\u015ft\u0131\u011f\u0131 web sunucusu yaz\u0131l\u0131m\u0131n\u0131 <a href=\"https:\/\/verimin.com.tr\/blog\/nginx-nedir-hangi-amacla-kullanilir\/\">NGINX Nedir? Hangi Ama\u00e7la Kullan\u0131l\u0131r?<\/a> yaz\u0131s\u0131nda tan\u0131tt\u0131k.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sunucu tabanl\u0131 WAF&#8217;\u0131n ay\u0131rt edici taraf\u0131 \u015fudur: iste\u011fi alan ad\u0131 seviyesinde de\u011fil, <strong>sunucu<\/strong> seviyesinde kar\u015f\u0131lar; trafik do\u011frudan sunucunun adresine geldi\u011finde bile devrede kal\u0131r. U\u00e7 noktada \u00e7al\u0131\u015fan bi\u00e7im ise farkl\u0131 bir mant\u0131k izler.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Bulut_tabanli_WAF_nasil_calisir\"><\/span>Bulut tabanl\u0131 WAF nas\u0131l \u00e7al\u0131\u015f\u0131r?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Bulut tabanl\u0131 WAF, iste\u011fi sunucuya ula\u015fmadan \u00f6nce sa\u011flay\u0131c\u0131n\u0131n u\u00e7 noktalar\u0131nda kar\u015f\u0131layarak \u00e7al\u0131\u015f\u0131r. Alan ad\u0131n\u0131n DNS kayd\u0131 sa\u011flay\u0131c\u0131ya y\u00f6nlendirilir, trafik \u00f6nce bu u\u00e7 a\u011fdan (CDN) ge\u00e7er, temizlenen istek sunucuya iletilir. Cloudflare ve AWS bu modelin en bilinen \u00f6rnekleridir; u\u00e7 a\u011f\u0131n \u00f6nbellek taraf\u0131n\u0131 <a href=\"https:\/\/verimin.com.tr\/blog\/cdn-hosting\/\">CDN Nedir? Hosting ile Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/a> yaz\u0131s\u0131nda, sa\u011flay\u0131c\u0131 taraf\u0131n\u0131 <a href=\"https:\/\/verimin.com.tr\/blog\/cloudflare-nedir-cloudflare-nasil-kullanilir-2025\/\">Cloudflare Nedir? Cloudflare Nas\u0131l Kullan\u0131l\u0131r? 2025<\/a> yaz\u0131s\u0131nda anlatt\u0131k.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bu modelin bir ko\u015fulu vard\u0131r. Bulut tabanl\u0131 WAF kullan\u0131yorsan\u0131z sunucunuzun ger\u00e7ek IP adresini d\u0131\u015far\u0131ya kapatmal\u0131, ba\u011flant\u0131y\u0131 yaln\u0131zca sa\u011flay\u0131c\u0131n\u0131n IP aral\u0131klar\u0131na a\u00e7mal\u0131s\u0131n\u0131z; aksi halde istek u\u00e7 a\u011f\u0131 hi\u00e7 g\u00f6rmeden sunucuya ula\u015f\u0131r ve katman devre d\u0131\u015f\u0131 kal\u0131r. \u00dc\u00e7\u00fcnc\u00fc bi\u00e7im uygulaman\u0131n kendi i\u00e7ine kurulur.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WordPresste_WAF_nasil_saglanir\"><\/span>WordPress&#8217;te WAF nas\u0131l sa\u011flan\u0131r?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress&#8217;te WAF, eklenti tabanl\u0131 ya da sunucu tabanl\u0131 olarak sa\u011flan\u0131r. Wordfence gibi g\u00fcvenlik eklentileri WAF g\u00f6revini uygulaman\u0131n i\u00e7inden y\u00fcr\u00fct\u00fcr ve kural setini y\u00f6netim panelinden y\u00f6netilebilir h\u00e2le getirir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aradaki fark kaynak t\u00fcketiminde ortaya \u00e7\u0131kar. Eklenti tabanl\u0131 WAF, PHP \u00e7al\u0131\u015fmaya ba\u015flad\u0131ktan sonra devreye girer; istek engellense bile sunucunun i\u015flemci ve bellek kayna\u011f\u0131 harcanm\u0131\u015ft\u0131r. Sunucu tabanl\u0131 WAF iste\u011fi PHP&#8217;ye ula\u015fmadan durdurur, yo\u011fun sald\u0131r\u0131 alt\u0131nda kaynak t\u00fcketimi d\u00fc\u015f\u00fck kal\u0131r. Di\u011fer sertle\u015ftirme ad\u0131mlar\u0131n\u0131 <a href=\"https:\/\/verimin.com.tr\/blog\/wordpress-guvenligi\/\">WordPress G\u00fcvenli\u011fi Nas\u0131l Sa\u011flan\u0131r? Kapsaml\u0131 Kontrol Listesi<\/a> yaz\u0131s\u0131nda listeledik. Hangi bi\u00e7im se\u00e7ilirse se\u00e7ilsin as\u0131l i\u015f ayar a\u015famas\u0131nda yap\u0131l\u0131r.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_kurulduktan_sonra_hangi_ayarlar_yapilir\"><\/span>WAF kurulduktan sonra hangi ayarlar yap\u0131l\u0131r?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WAF kurulduktan sonra yap\u0131lacak ayarlar a\u015fa\u011f\u0131da s\u0131rayla verilmi\u015ftir:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Ba\u015flat.<\/strong> WAF&#8217;\u0131 \u00f6nce denetim (log-only) modunda \u00e7al\u0131\u015ft\u0131r; bu modda istekler engellenmez, yaln\u0131zca kaydedilir.<\/li><li><strong>Oku.<\/strong> Denetim modunun ilk <strong>3\u20137 g\u00fcnl\u00fck<\/strong> loglar\u0131n\u0131 incele, hangi kural\u0131n hangi iste\u011fi yakalad\u0131\u011f\u0131n\u0131 \u00e7\u0131kar.<\/li><li><strong>Muaf tut.<\/strong> Me\u015fru istekleri yakalayan kurallar i\u00e7in tek tek muafiyet tan\u0131mla.<\/li><li><strong>G\u00fcncelle.<\/strong> Kural setini d\u00fczenli g\u00fcncelle; yeni sald\u0131r\u0131 kal\u0131plar\u0131 g\u00fcncellemelerle girer.<\/li><li><strong>K\u0131s\u0131tla.<\/strong> Y\u00f6netim panelini IP tabanl\u0131 kuralla yaln\u0131zca bilinen adreslere a\u00e7.<\/li><li><strong>S\u0131n\u0131rla.<\/strong> Ayn\u0131 kaynaktan gelen istek say\u0131s\u0131na bir \u00fcst s\u0131n\u0131r tan\u0131mla.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Ad\u0131mlar\u0131n hepsi log okumaya dayan\u0131r; sunucu loglar\u0131n\u0131n nas\u0131l okunaca\u011f\u0131n\u0131 <a href=\"https:\/\/verimin.com.tr\/blog\/sunucu-loglari\/\">Sunucu Loglar\u0131 Nedir? Nas\u0131l Okunur ve \u0130zlenir?<\/a> yaz\u0131s\u0131nda anlatt\u0131k. \u00dc\u00e7\u00fcnc\u00fc ve alt\u0131nc\u0131 ad\u0131m en s\u0131k soru \u00e7\u0131karan ikisidir.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_yanlis_pozitif_verirse_ne_yapilir\"><\/span>WAF yanl\u0131\u015f pozitif verirse ne yap\u0131l\u0131r?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WAF yanl\u0131\u015f pozitif verirse, iste\u011fi engelleyen kural log kayd\u0131ndan bulunur ve yaln\u0131zca o kural i\u00e7in muafiyet tan\u0131mlan\u0131r. Belirtisi nettir: kaydedilen bir yaz\u0131 ya da y\u00fcklenen bir dosya beklenmedik bi\u00e7imde <strong>HTTP 403<\/strong> yan\u0131t\u0131yla d\u00f6ner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Log sat\u0131r\u0131nda engellemeyi yapan kural\u0131n kimli\u011fi (rule ID) yazar; muafiyet bu kimlikle tan\u0131mlan\u0131r. Ayn\u0131 yan\u0131t kodunun WAF d\u0131\u015f\u0131ndaki sebeplerini <a href=\"https:\/\/verimin.com.tr\/blog\/403-forbidden-hatasi\/\">403 Forbidden Hatas\u0131 Nedir? Nedenleri ve \u00c7\u00f6z\u00fcm Y\u00f6ntemleri<\/a> yaz\u0131s\u0131nda ay\u0131rd\u0131k. \u00c7\u00f6z\u00fcm i\u00e7in WAF&#8217;\u0131 t\u00fcm\u00fcyle kapatmamal\u0131, kural baz\u0131nda muafiyet tan\u0131mlamal\u0131s\u0131n\u0131z.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_istek_sayisini_nasil_sinirlar\"><\/span>WAF istek say\u0131s\u0131n\u0131 nas\u0131l s\u0131n\u0131rlar?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WAF, ayn\u0131 kaynaktan gelen istek say\u0131s\u0131n\u0131 belirli bir zaman aral\u0131\u011f\u0131nda sayarak s\u0131n\u0131rlar. \u00d6rne\u011fin giri\u015f formuna <strong>dakikada 10 istek<\/strong> e\u015fi\u011fi tan\u0131mlan\u0131r; e\u015fi\u011fi a\u015fan kaynak ge\u00e7ici olarak durdurulur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">S\u0131n\u0131r\u0131 a\u015fan iste\u011fe d\u00f6nen yan\u0131t <strong>HTTP 429<\/strong>&#8216;dur; kodun anlam\u0131n\u0131 ve sunucu taraf\u0131ndaki kar\u015f\u0131l\u0131\u011f\u0131n\u0131 <a href=\"https:\/\/verimin.com.tr\/blog\/429-too-many-requests\/\">429 Too Many Requests Hatas\u0131 Nedir? Nedenleri ve \u00c7\u00f6z\u00fcm\u00fc<\/a> yaz\u0131s\u0131nda ele ald\u0131k. H\u0131z s\u0131n\u0131r\u0131 en \u00e7ok giri\u015f formu ve API u\u00e7 noktalar\u0131nda i\u015fe yarar. Yine de bu ayarlar WAF&#8217;\u0131 tek ba\u015f\u0131na yeterli h\u00e2le getirmez.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_tek_basina_neden_yeterli_degildir\"><\/span>WAF tek ba\u015f\u0131na neden yeterli de\u011fildir?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WAF tek ba\u015f\u0131na yeterli de\u011fildir, \u00e7\u00fcnk\u00fc WAF iste\u011fi filtreler, uygulamadaki a\u00e7\u0131\u011f\u0131 kapatmaz. Bunun d\u00f6rt gerek\u00e7esi vard\u0131r. A\u00e7\u0131k, kaynak kodunda durdu\u011fu s\u00fcrece varl\u0131\u011f\u0131n\u0131 s\u00fcrd\u00fcr\u00fcr. \u0130mza tabanl\u0131 kurallar yaln\u0131zca tan\u0131d\u0131klar\u0131 kal\u0131b\u0131 yakalar, tan\u0131mad\u0131klar\u0131 bir istek bi\u00e7imi filtreden ge\u00e7ebilir. U\u00e7 noktada \u00e7al\u0131\u015fan bir WAF kullan\u0131l\u0131yorsa ve sunucunun ger\u00e7ek adresi a\u00e7\u0131ksa katman ba\u015ftan devre d\u0131\u015f\u0131 kalabilir. Ge\u00e7erli kimlik bilgisiyle yap\u0131lan istek me\u015fru g\u00f6r\u00fcnd\u00fc\u011f\u00fc i\u00e7in kuralla e\u015fle\u015fmez.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bu b\u00f6l\u00fcm\u00fcn amac\u0131 atlatma y\u00f6ntemi tarif etmek de\u011fil, tek katmanl\u0131 savunman\u0131n neden yetersiz kald\u0131\u011f\u0131n\u0131 g\u00f6stermektir. Savunma taraf\u0131ndaki cevap d\u00f6rt katman\u0131 birlikte kurmakt\u0131r: uygulamay\u0131 ve eklentilerini g\u00fcncel tutmak, her hesaba yaln\u0131zca ihtiyac\u0131 kadar yetki vermek, ayn\u0131 sunucudaki hesaplar\u0131 birbirinden yal\u0131tmak ve geri d\u00f6n\u00fclebilir bir yedek tutmak. Yal\u0131t\u0131m\u0131n payla\u015f\u0131ml\u0131 sunucularda nas\u0131l sa\u011fland\u0131\u011f\u0131n\u0131 <a href=\"https:\/\/verimin.com.tr\/blog\/cloudlinux-nedir-hosting-sunucularinda-ne-ise-yarar\/\">CloudLinux Nedir? Hosting Sunucular\u0131nda Ne \u0130\u015fe Yarar?<\/a> yaz\u0131s\u0131nda, a\u011f seviyesindeki katman\u0131 <a href=\"https:\/\/verimin.com.tr\/blog\/ddos-korumali-vds\/\">DDoS Korumal\u0131 VDS Nedir? Koruma Katmanlar\u0131 ve Se\u00e7im Kriterleri<\/a> yaz\u0131s\u0131nda anlatt\u0131k.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_hakkinda_sik_sorulan_sorular\"><\/span>WAF hakk\u0131nda s\u0131k sorulan sorular<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"WAF_siteyi_yavaslatir_mi\"><\/span>WAF siteyi yava\u015flat\u0131r m\u0131?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Evet, WAF her iste\u011fe \u00f6l\u00e7\u00fclebilir ama k\u00fc\u00e7\u00fck bir gecikme ekler. Sunucu tabanl\u0131 bir WAF&#8217;\u0131n istek ba\u015f\u0131na ekledi\u011fi s\u00fcre <strong>milisaniye<\/strong> mertebesindedir. Bulut tabanl\u0131 WAF \u00f6nbellekle \u00e7al\u0131\u015ft\u0131\u011f\u0131nda toplam yan\u0131t s\u00fcresini d\u00fc\u015f\u00fcrebilir.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Ucretsiz_WAF_yeterli_midir\"><\/span>\u00dccretsiz WAF yeterli midir?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Evet, \u00e7o\u011fu site i\u00e7in \u00fccretsiz WAF yeterlidir. OWASP Core Rule Set \u00fccretsizdir ve yayg\u0131n sald\u0131r\u0131 s\u0131n\u0131flar\u0131n\u0131 kapsar. \u00dccretli setlerin fark\u0131 kapsamda de\u011fil, g\u00fcncelleme h\u0131z\u0131nda ve destektedir.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"SSL_sertifikasi_WAF_yerine_gecer_mi\"><\/span>SSL sertifikas\u0131 WAF yerine ge\u00e7er mi?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Hay\u0131r, SSL sertifikas\u0131 WAF&#8217;\u0131n yerine ge\u00e7mez. SSL trafi\u011fi \u015fifreler, iste\u011fin i\u00e7eri\u011fini denetlemez; zararl\u0131 bir istek de \u015fifreli kanaldan ayn\u0131 \u015fekilde gelir. \u0130kisi birlikte \u00e7al\u0131\u015f\u0131r: WAF i\u00e7eri\u011fi ancak TLS ba\u011flant\u0131s\u0131 sonland\u0131r\u0131ld\u0131ktan sonra okur. Sertifikan\u0131n ne zaman yeterli oldu\u011funu <a href=\"https:\/\/verimin.com.tr\/blog\/ucretsiz-ssl-nedir\/\">\u00dccretsiz SSL Nedir? Nas\u0131l Al\u0131n\u0131r ve Ne Zaman Yeterli Olur?<\/a> yaz\u0131s\u0131nda ayr\u0131nt\u0131land\u0131rd\u0131k.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Paylasimli_hosting_paketinde_WAF_kullanilabilir_mi\"><\/span>Payla\u015f\u0131ml\u0131 hosting paketinde WAF kullan\u0131labilir mi?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Evet, payla\u015f\u0131ml\u0131 hosting paketinde WAF kullan\u0131labilir. Sunucu tabanl\u0131 WAF kontrol paneli \u00fczerinden hesap d\u00fczeyinde a\u00e7\u0131l\u0131p kapat\u0131l\u0131r, kural seti ise sunucu genelinde y\u00f6netilir. Paketlerin panel i\u00e7eri\u011fini <a href=\"https:\/\/verimin.com.tr\/web-hosting\">Limitsiz Web Hosting<\/a> sayfas\u0131nda inceleyebilirsiniz.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Belirleyici olan WAF&#8217;\u0131n a\u00e7\u0131k olmas\u0131 de\u011fil, kural setinin g\u00fcncel tutulmas\u0131 ve yanl\u0131\u015f pozitiflerin ay\u0131klanmas\u0131d\u0131r. Bu i\u015f sunucuyu y\u00f6neten taraf\u0131n sorumlulu\u011fundad\u0131r; kendi ekibinizle y\u00fcr\u00fctmek istemiyorsan\u0131z kural seti y\u00f6netimini, log takibini ve g\u00fcncellemeyi sa\u011flay\u0131c\u0131ya devreden <a href=\"https:\/\/verimin.com.tr\/yonetilen-sunucu\">Y\u00f6netilen Sunucular<\/a> hizmetini de\u011ferlendirebilirsiniz.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WAF (web application firewall), bir web uygulamas\u0131na gelen HTTP ve HTTPS isteklerini uygulama katman\u0131nda denetleyen&#8230;<\/p>\n","protected":false},"author":1,"featured_media":2246,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2254","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-genel"],"_links":{"self":[{"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/posts\/2254","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=2254"}],"version-history":[{"count":1,"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/posts\/2254\/revisions"}],"predecessor-version":[{"id":2263,"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/posts\/2254\/revisions\/2263"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/media\/2246"}],"wp:attachment":[{"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=2254"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=2254"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/verimin.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=2254"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}