Skip to content Skip to navigation Skip to footer

Overview

FortiWeb defends web applications and APIs against OWASP Top-10 threats, DDOS attacks, and malicious bot attacks. Advanced ML-powered features improve security and reduce administrative overhead. Capabilities include anomaly detection, API discovery and protection, bot mitigation, and advanced threat analytics to identify the most critical threats across all protected applications.

FortiWeb VM is part of the new FortiFlex program, providing you the flexibility to right-size your services and spend.

Web Application Security

Block known and zero-day threats to applications without blocking legitimate users and without the excessive management overhead that traditional application learning requires. Using machine learning to model each application, FortiWeb identifies malicious anomalies to block threats without generating the false positives that drive administrative overhead.

Bot Defense

Stop malicious bot activity without blocking bots that support legitimate business needs, such as search engines, or health and performance monitoring tools.  Reduce reliance on outdated techniques that degrade the user experience, and leverage advanced techniques such as bot deception, biometric detection, and machine learning to accurately identify and manage bot traffic. FortiWeb Bot Mitigation provides the visibility and control you need without slowing down your users with unnecessary captchas or challenges.

API Discovery and Protection

Protect the APIs that enable business-to-business communications and support mobile applications. FortiWeb API Discovery and Protection uses machine learning algorithms to automatically discover APIs by continuously evaluating application traffic. FortiWeb can also integrate out-of-the-box policies together with an automatically generated positive security model policy based on your organization’s schema specification (OpenAPI, XML, JSON), to protect against API exploits. Protect your APIs and seamlessly integrate API security into your CI/CD pipeline.

Features and Benefits

Web applications and APIs have become the tools of choice for building business-critical applications, and those applications must keep up with needs of the business. FortiWeb offers the performance, manageability, and broad protection capabilities required to protect modern web applications. 

Web Application Protection

Protects against all OWASP Top-10 threats, DDOS attacks, bot attacks, and more. 

ML-Based Threat Detection

Uses ML to protect against zero-day attacks and minimize false positives, along with other defenses.

Security Fabric Integration

Integrates with FortiGate NGFWs and FortiSandbox to defend against advanced persistent threats (APTs)

Advanced Analytics

Streamlines workflows with recommended playbooks and threat-hunting capabilities 

False Positive Mitigation

Minimizes day-to-day management of policies and exception lists so only unwanted traffic is blocked

Hardware-Based Acceleration

Offers industry-leading protected WAF throughputs and rapid traffic encryption/decryption

69%

Of surveyed organizations use two or more cloud providers.*

50%

Of surveyed organizations expect to be running more than 50% of their workloads in the cloud.*

51%

Of cybersecurity professionals see insecure interfaces and APIs as the biggest public cloud security threat threat.*

FortiWeb Use Cases

Web Application
Web Application Security
Block known and zero-day threats to applications without blocking legitimate users.
icon anti botnet
Bot Defense
Stop malicious bot activity without blocking bots that support legitimate business needs.
integration icon
API Discovery and Protection
Protect the APIs that enable B2B communications and support your mobile applications.
icon incident management
SOC Operations
Use threat analytics to consolidate raw event data into a clear picture of the most significant threats.
icon compliance
Regulatory Compliance
Address regulatory compliance requirements related to public-facing applications, including PCI-DSS requirements.

FortiGuard AI-Powered Security Services

FortiWeb employs multiple FortiGuard security services to protect web applications from attack. These annual subscriptions can be purchased a la carte or as part of a bundle with your FortiWeb solution. 

Case Studies

Laguna Woods Village
Laguna Woods Village
FortiGuard Incident Response Helps Large Planned Community Recover from Ransomware
Sandy Alexander
Sandy Alexander
Fortinet Gives Marketing Firm Maximum Protection While Requiring Minimum Staff Time
OutSystems
OutSystems
Global Low-Code Pioneer Improves Resilience and Cuts Management Complexity Both On-Premises and in the Cloud
Manetoni
Manetoni
Brazilian Steel Distributor Achieves High Security and Availability with the Fortinet Security Fabric Platform

Models and Specifications

FortiWeb is available in many different form factors to meet your needs ranging from entry-level hardware appliances to sophisticated VM options that be incorporated into latest cloud environments.

View by:

FortiWeb appliances use multi-core processor technology combined with hardware-based SSL tools to deliver blazing fast protected WAF throughput.
 

Throughput
50 Mbps
Ports
4x GE RJ45
Throughput
250 Mbps
Ports
4x GE RJ45, 4x GE SFP
Throughput
750 Mbps
Ports
4x GE RJ45 (2x bypass), 4x GE SFP
Throughput
1.3 Gbps
Ports
2x 10 GE SFP+, 2x GE RJ45, 4x GE RJ45 bypass, 4x GE SFP
Throughput
5 Gbps
Ports
4x GE RJ45 (4 bypass), 4 SFP GE RJ45, 4 x 10 GE SFP+
Throughput
10 Gbps
Ports
8x GE (8 bypass), 10x 10G SFP+ (2 bypass)
Throughput
70 Gbps
Ports
8x GE (8 bypass), 10x 10G SFP+ (2 bypass), 2x 40G QSFP (2 bypass)

The virtual versions of FortiWeb can be deployed in VMware, Microsoft Hyper-V, Citrix XenServer, Open Source Xen, VirtualBox, KVM and Docker platforms.

Please see FortiWeb VM Installation Guide for versions supported.

Throughput
25 Mbps
vCPU
1
Throughput
100 Mbps
vCPU
2
Throughput
500 Mbps
vCPU
4
Throughput
3 Gbps
vCPU
8

Actual performance values may vary depending on the network traffic and system configuration. Performance metrics were observed using a Dell PowerEdge R710 server (2x Intel Xeon E5504 2.0 GHz 4 MB Cache) running VMware ESXi 5.5 with 4 GB of vRAM assigned to the 4 vCPU and 8 vCPU FortiWeb Virtual Appliance and 4 GB of vRAM assigned to the 2 vCPU FortiWeb Virtual Appliance.

FortiWeb is available in all major public cloud providers, including Amazon Web Services (AWS), Microsoft Azure, Oracle, and Google.  Amazon Web Services (AWS) and Microsoft Azure are supported for both BYOL (bring your own license) and On-demand (pay-as-you go). Please see the cloud Marketplace listings for more information:

FortiWeb container appliances secure your workloads and data in containerized environments.

Throughput
25 Mbps
Throughput
100 Mbps
Throughput
500 Mbps
Throughput
3 Gbps

Throughputs and other metrics are maximum values permitted for each version. Actual performance values may vary depending on the network traffic and system configuration.

FortiWeb Cloud WAF-as-a-Service is a SaaS cloud-based web application firewall (WAF) that protects public cloud hosted web applications from the OWASP Top 10, zero day threats and other application layer attacks. 

Requiring no hardware or software, FortiWeb Cloud WAF as a Service employs gateways running in most AWS regions to scrub your application traffic within the same region your applications reside.  Scrubbing traffic in region addresses performance and regulatory concerns and keeping traffic cost to minimum.

With a built in simple setup wizard and predefined policies, FortiWeb Cloud delivers the security you need within minutes, removing the usual complexity required when setting up a WAF. More advanced users can easily enable additional security modules if needed, free of charge. 

For more information, visit here.

FortiCare Support & Professional Services

Fortinet is dedicated to helping our customers succeed, and every year FortiCare services help thousands of organizations get the most from their investments in Fortinet's products and services. To achieve this, FortiCare follows the life-cycle approach and provides unique services to help our customers in their success journeys.

Technical Support Services

Technical Support Services

Various per-device options are available for efficient operations. FortiCare Elite option provides a 15-minute response time for critical products.

Advanced Support

Advanced Support

Various per-account white glove services are available to reduce disruption and increase productivity with operational reviews by designated experts.

Professional Services

Professional Services

Our multi-vendor experts can design and deploy a complete best practice-based solution to help you meet your network or security objectives and adopt new capabilities.

RMA

RMA

Priority RMA options are available across the product family for expedited replacement of defective hardware to meet your availability objectives.

Resources

Data Sheets
Analyst Reports
Checklists
eBooks
Solution Briefs
Videos
Webinars
White Papers

Ecosystem

Training & Certifications

Fortinet Certified Professional - Public Cloud Security
In this three-day class, you will learn how to deploy, configure, and troubleshoot Fortinet's web application firewall: FortiWeb.
Other Training
Learn how to protect your organization and improve its security against advanced threats that bypass traditional security controls. You will also learn how other advanced threat protection (ATP) components—FortiGate, FortiMail, FortiWeb, and FortiClient—leverage this threat intelligence information to protect organizations from advanced threats.
In this course, you will explore web application threats and countermeasures focused on Fortinet Solution. You will learn the motivations of attacks on web applications through to understanding and executing attack techniques and then learn how to configure Fortinet Solution to mitigate them.

Free Product Demo

This full working demo lets you explore the many features of our FortiWeb Web Application Firewall (WAF). You’ll quickly see how FortiWeb easily displays system resource utilization and attack logs, and gives you everything you need in the easy-to-use attack console. Be sure to check out our comprehensive web protection profiles and in-depth reporting. 

FortiWeb News

FortiWeb Threat Analytics

Fortinet introduces AI-based Threat Analytics to help SOC analysts zoom in on the most important threats across the full web application attack surface, including all web applications protected by FortiWeb and FortiWeb cloud.

2023 Cloud Security Report

The 2023 Cloud Security Report discusses how securing applications in the cloud remains a leading priority for organizations going into 2023.

2H 2022 Global Threat Landscape Report

Fortinet’s latest Global Threat Landscape Report shows how exploiting public-facing applications continues to be the second most popular way threat actors gain initial access.