Firewall, WAF, DDoS, Rate Limiting: Four Words on Your Quote, Explained With a Building Lobby and a Bubble Tea Shop

The four lines on your quote you never questioned

A NT$450,000 website rebuild quote ends with: "Includes firewall configuration, WAF deployment, DDoS protection and API rate limiting — add NT$60,000." The owner frowns. Isn't that all just the firewall? Why pay four times?

They do all "block bad stuff", but they guard completely different gates: a key card, a lobby guard, three thousand people surging through the door at once, and the bubble tea shop sign saying "five drinks per customer". Confusing them means you paid for protection against the wrong thing.

Firewall: the key card at the building entrance

In one line: it decides who, from where, through which door, may reach your server at all.

Your server is an apartment building and the firewall is the entrance system: residents badge in, visitors use the visitor lane, side doors stay locked. It only looks at where you came from — never at what you are carrying.

A metal fabrication plant in Taichung runs its ERP in its own server room, and to save time left database port 3306 open to the entire internet. Done right, only the company's fixed IP and VPN get through. Done wrong, it is a wide-open lobby with a "come on in" sign. Tightening the rules is typically 2–4 hours of labour, and it is the highest-return of the four layers.

WAF: the lobby guard who checks what you are carrying

In one line: a filter that inspects the content of web requests, blocking legitimate-looking traffic that carries attack payloads.

The firewall sends visitors down the visitor lane. But what if this visitor is carrying a jerry can of petrol? A WAF (Web Application Firewall) is the lobby guard who stops you and looks at what you brought.

A Taipei aesthetic clinic's online booking form had SQL syntax typed into its "notes" field, an attempt to dump the whole client list. To a firewall that request is perfectly legal: normal port 443, normal submission. Only a WAF catches it, matching the payload against injection patterns from the OWASP Top 10 and discarding it. For clinics and cram schools holding national ID numbers and medical records, this layer is an obligation, not a nice-to-have.

DDoS: three thousand people crowd your shop and buy nothing

In one line: flooding your site with fake traffic so real customers cannot get in.

DDoS steals nothing. It sends three thousand people to stand inside your shop. Your guard is useless, because every one of them looks legitimate on their own.

A cram school's enrolment day or a restaurant's reservation window is when this hurts most: thirty minutes of downtime destroys the most important hour of the year. And you do not need a nation-state attack. The Cloudflare DDoS Threat Report for H1 2026 found 96.62% of network-layer attacks stayed under 500 Mbps and 90.60% ended within ten minutes. The bad news: 500 Mbps flattens one unprotected SME server.

Rate limiting: five drinks per customer

In one line: a cap on how many times one client may act within a time window.

The "five drinks per customer" sign at a busy tea shop is not hostility — it lets the people behind you order too. Past the cap, the server returns HTTP 429 Too Many Requests and asks them to retry later.

The most concrete example is the SMS bill. A restaurant chain's reservation flow sends a verification code. With no rate limit, a script triggered it all night and pushed 50,000 messages. At NT$0.8 each that is NT$40,000 burned overnight, with not one real booking. OWASP lists Unrestricted Resource Consumption as API4:2023 for exactly this reason: what bleeds is the invoice.

How the four gates connect

Picture concentric circles from outside in. The outermost is the network layer, where DDoS traffic lands and is absorbed by upstream scrubbing. The second is the firewall, deciding who connects and on which port. The third is the WAF, inspecting each request's content. The innermost is rate limiting, living inside your own code and APIs.

None substitutes for another: a firewall cannot stop a legal request carrying an injection payload, a WAF cannot stop three thousand individually legal connections, and DDoS protection has no idea your SMS API was hit 50,000 times.

What it means for budget, schedule and risk

Money: firewall rules are usually already in your hosting management fee. For a cloud WAF, AWS WAF official pricing is US$5 per web ACL per month, US$1 per rule per month and US$0.60 per million requests — 20 rules at 5 million monthly requests is about US$28, under NT$900. A four-figure NTD monthly cost, not a six-figure project.
Schedule: firewall tightening 2–4 hours; WAF deployment including false-positive tuning 8–16 hours; rate limiting roughly 1–2 hours per critical API. The whole package is 3–5 working days.
Risk: the comparison is the "after" cost — breach notification duties and reputational damage, the revenue hole from two hours down on enrolment day, a NT$40,000 SMS bill overnight. Any one of them dwarfs that NT$60,000.

Five questions to ask your vendor

"Is our database port exposed to the internet? Can you send me the current firewall allow-list?"
"Is the WAF a cloud service or a host module? Which ruleset? What happens when it blocks our own staff?"
"Is DDoS protection included, or an add-on we buy after we get hit? What is the billing cap on overage traffic?"
"What rate limits are on login, SMS verification and order submission? Does an excess return 429, or does the service fall over?"
"How long are logs kept at each layer? During an incident, what do I look at and who do I call?"

Common misconceptions

"We have SSL, so we are secure." SSL only guarantees nobody reads the traffic in transit. It will faithfully encrypt an attack payload and deliver it to your server. Encryption and filtering are different jobs.
"We are small, nobody targets us." Most attacks are automated scans that do not pick targets — the same way a burglar walks down a street testing door handles.

FAQ

Does a small business really need all four layers?

Yes, at varying depth. Firewall and rate limiting cost almost nothing, so there is no reason to skip them. A WAF is necessary once you have forms, member accounts or payments. DDoS protection depends on whether you have time-sensitive peaks like enrolment day or launch day.

Is a cloud provider's free plan enough?

For most small and mid-sized sites, a free plan stops common automated attacks. What is usually missing is a hard cap on custom rules, very short log retention, and no fine-grained exclusion tooling when something is wrongly blocked. Once the site carries payments or personal data, upgrading is worth it.

Our site runs on a SaaS platform or shared hosting. Do we still manage this?

The platform usually covers the network and host layers, but rate limiting and form content validation stay in your application. That is especially true for SMS, payment and email APIs you integrated yourself — the platform will not block abuse for you, and the invoice still comes to you.

Next step

If you are holding a security quote you cannot decode, or want to know which of these four layers your current site is missing, we can run a 30-minute review and tell you exactly which layer is empty and how many hours it takes to close.